PT-2022-13683 · WordPress · Jobmonster Theme

Daniel Ruf · Published 2022-04-04 · Updated 2022-05-10 · CVE-2022-1166

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions JobMonster Theme (affected versions not specified)

Description The issue allows for Directory Listing in the /wp-content/uploads/jobmonster/ folder due to the absence of a default PHP file or .htaccess file. This could potentially expose sensitive personal data, such as resumes. While secure web server configuration can prevent Directory Listing, vendors can also implement measures to reduce its likelihood.

Recommendations For the JobMonster Theme, consider adding a default PHP file or configuring an .htaccess file to prevent Directory Listing in the /wp-content/uploads/jobmonster/ folder. As a temporary workaround, restrict access to the /wp-content/uploads/jobmonster/ folder to minimize the risk of sensitive data exposure.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-1166

Affected Products

Jobmonster Theme

References · 4

• 🔥 https://wpscan.com/vulnerability/ea6646ac-f71f-4340-965d-fab272da5189 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-1166 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1166 · Vendor Advisory
• https://themeforest.net/item/jobmonster-job-board-wordpress-theme/10965446 · Note