Lucene search

WPScanCVE-2022-1166

HistoryApr 04, 2022 - 4:15 p.m.

CVE-2022-1166

2022-04-0416:15:10

CWE-22

WPScan

web.nvd.nist.gov

jobmonster theme

directory listing

vulnerability

web server configuration

personal data exposure

cve-2022-1166

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.1

Confidence

High

EPSS

0.001

Percentile

30.7%

JSON

The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess file. This could expose personal data such as people’s resumes. Although Directory Listing can be prevented by securely configuring the web server, vendors can also take measures to make it less likely to happen.

Affected configurations

Nvd

Vulners

Node

noothemejobmonsterRange<4.6.6.1wordpress

VendorProductVersionCPE
noothemejobmonster*cpe:2.3:a:nootheme:jobmonster:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
nootheme	jobmonster	*	cpe:2.3:a:nootheme:jobmonster::::::wordpress::*

CNA Affected

[
  {
    "product": "Noo JobMonster",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "4.5.2.9",
        "status": "affected",
        "version": "4.5.2.9",
        "versionType": "custom"
      }
    ]
  }
]

References

themeforest.net/item/jobmonster-job-board-wordpress-theme/10965446

wpscan.com/vulnerability/ea6646ac-f71f-4340-965d-fab272da5189

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.1

Confidence

High

EPSS

0.001

Percentile

30.7%

JSON

Related for CVE-2022-1166