CVE-2022-1166

The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess file. This could expose personal data such as people's resumes. Although Directory Listing can be prevented by securely configuring the web server, vendors can also take measures to make it less likely to happen.

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

1.55% chance of exploitation in the next 30 days, 73th percentile

Published

2022-04-04

Updated

2024-08-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/ea6646ac-f71f-4340-965d-fab272da5189

References

• CVE Record
• NVD entry

Related

• CVE-2022-1165
• CVE-2022-1167
• CVE-2022-1164
• CVE-2022-1168
• CVE-2022-1163
• CVE-2022-1169