Exposure of Information Through Directory Listing
CWE-548
The product inappropriately exposes a directory listing with an index of all the resources located inside of the directory.
We track 15 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.5.
How this weakness is prevented
- Architecture and Design System Configuration: Recommendations include restricting access to important directories or files by adopting a need to know requirement for both the document and server root, and turning off features such as Automatic Directory Listings that could expose private files and provide information that could be utilized by an attacker when formulating or conducting an attack.
Latest Exposure of Information Through Directory Listing vulnerabilities
- 7.1 High severity
Red Hat OpenShift Container Platform 4: Exposure of Information Through Directory Listing
A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack. The controller registers an HTTP file server on port 8084 with no authentication. The custom imageFileSystem implementation exposes a browsable HTML direc
- 7.5 High severity
PowerFlex Manager (Appliance): Exposure of Information Through Directory Listing
Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
- 7.5 High severity
rack: Improper Limitation of a Pathname to a Restricted Directory
Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path start
- 7.5 High severity
Impact/Pulse/First: Exposure of Information Through Directory Listing
SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive log files. Attackers can directly browse the /log directory to retrieve system and sensitive information without auth
- 7.6 High severity
Gxp1628 Firmware: Exposure of Information Through Directory Listing
Grandstream Networks GXP1628 <=1.0.4.130 is vulnerable to Incorrect Access Control. The device is configured with directory listing enabled, allowing unauthorized access to sensitive directories and files.
- 7.5 High severity
Endress+Hauser MEAC300-FNADE4: Exposure of Information Through Directory Listing
The configuration of the Apache httpd webserver which serves the MEAC300-FNADE4 web application, is partly insecure. There are modules activated that are not required for the operation of the FNADE4 web application. The functionality of the some modules pose a
- 7.3 High severity
Client Database Management System: Files or Directories Accessible to External Parties
A vulnerability classified as critical was found in SourceCodester Client Database Management System 1.0. This vulnerability affects unknown code. The manipulation leads to exposure of information through directory listing. The attack can be initiated remotely
- 7.5 High severity
Online Student Clearance System: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability, which was classified as problematic, was found in SourceCodester Online Student Clearance System 1.0. This affects an unknown part. The manipulation leads to exposure of information through directory listing. It is possible to initiate the att
- 7.5 High severity
Employee and Visitor Gate Pass Logging System: Exposure of Information Through Directory Listing
A vulnerability has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to exposure of information through directory li
- 7.3 High severity
Blood Bank Management System: Files or Directories Accessible to External Parties
A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /upload/. The manipulation leads to exposure of information through directory listing. The attack
- 7.5 High severity
Security Directory Integrator: Exposure of Information Through Directory Listing
IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 could disclose sensitive information about directory contents that could aid in further attacks against the system.
- 7.5 High severity
Food Ordering Management System: Exposure of Information Through Directory Listing
A vulnerability, which was classified as problematic, has been found in SourceCodester Food Ordering Management System 1.0. Affected by this issue is some unknown functionality of the file /includes/. The manipulation leads to exposure of information through d
- 7.5 High severity
customer_support_system: Missing Authorization
A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the application without requiring authorization.
- 7.5 High severity
g5_digital_fault_recorder: Exposure of Information Through Directory Listing
An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Unauthenticated directory listing can occur: the web interface cay be abused be an attacker get a better understanding of the operating system.
- 7.5 High severity
Actinas Sl 2u-8 Rdx Firmware: Exposure of Information Through Directory Listing
A Site-wide directory listing vulnerability in /fm in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to list the files hosted by the web application.