CVE-2022-1166

JobMonster < 4.6.6.1 - Directory Listing in Upload Folder

The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess file. This could expose personal data such as people's resumes. Although Directory Listing can be prevented by securely configuring the web server, vendors can also take measures to make it less likely to happen.

Affected

Noo JobMonster

CVSS v3.1 NVD

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

1.55% chance of exploitation in the next 30 days, 75th percentile

Published

2022-04-04

Updated

2024-08-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/ea6646ac-f71f-4340-965d-fab272da5189

Security advisories

• https://themeforest.net/item/jobmonster-job-board-wordpress-theme/10965446

References

• CVE Record
• NVD entry