Vulnerability Details CVE-2022-2544
The Ninja Job Board WordPress plugin before 1.3.3 does not protect the directory where it stores uploaded resumes, making it vulnerable to unauthenticated Directory Listing which allows the download of uploaded resumes.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.725
EPSS Ranking 98.7%
CVSS Severity
CVSS v3 Score 7.5
References
- https://plugins.trac.wordpress.org/changeset/2758420/ninja-job-board/trunk/includes/Classes/File/FileHandler.php?old=2126467&old_path=ninja-job-board%2Ftrunk%2Fincludes%2FClasses%2FFile%2FFileHandler.php
- https://wpscan.com/vulnerability/a9bcc68c-eeda-4647-8463-e7e136733053
- https://plugins.trac.wordpress.org/changeset/2758420/ninja-job-board/trunk/includes/Classes/File/FileHandler.php?old=2126467&old_path=ninja-job-board%2Ftrunk%2Fincludes%2FClasses%2FFile%2FFileHandler.php
- https://wpscan.com/vulnerability/a9bcc68c-eeda-4647-8463-e7e136733053
Products affected by CVE-2022-2544
-
cpe:2.3:a:wpmanageninja:ninja_job_board:1.0.0
-
cpe:2.3:a:wpmanageninja:ninja_job_board:1.2.2
-
cpe:2.3:a:wpmanageninja:ninja_job_board:1.3.1