VulnerabilityModified
CVE-2022-2544
The Ninja Job Board WordPress plugin before 1.3.3 does not protect the directory where it stores uploaded resumes, making it vulnerable to unauthenticated Directory Listing which allows the download of uploaded resumes.
HIGH 7.5EPSS 4.27%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.27%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The Ninja Job Board WordPress plugin before 1.3.3 does not protect the directory where it stores uploaded resumes, making it vulnerable to unauthenticated Directory Listing which allows the download of uploaded resumes.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 4.27% probability · 91th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-425
- Affected
- wpmanageninja/ninja job board
- Source
- contact@wpscan.com
References
- https://plugins.trac.wordpress.org/changeset/2758420/ninja-job-board/trunk/includes/Classes/File/FileHandler.php?old=2126467&old_path=ninja-job-board%2Ftrunk%2Fincludes%2FClasses%2FFile%2FFileHandler.phpPatch, Third Party Advisory
- https://wpscan.com/vulnerability/a9bcc68c-eeda-4647-8463-e7e136733053Exploit, Third Party Advisory
- https://plugins.trac.wordpress.org/changeset/2758420/ninja-job-board/trunk/includes/Classes/File/FileHandler.php?old=2126467&old_path=ninja-job-board%2Ftrunk%2Fincludes%2FClasses%2FFile%2FFileHandler.phpPatch, Third Party Advisory
- https://wpscan.com/vulnerability/a9bcc68c-eeda-4647-8463-e7e136733053Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.