CVE-2022-30625

Directory listing is a web server function that displays the directory contents when there is no index file in a specific website directory. A directory listing provides an attacker with the complete index of all the resources located inside of the directory. The specific risks and consequences vary depending on which files are listed and accessible.

CVSS v3 5.7 MEDIUM

5.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.5 / Impact : 3.7

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://www.gov.il/en/Departments/faq/cve_advisories	Third Party Advisory
https://www.gov.il/en/Departments/faq/cve_advisories	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:chcnav:p5e_gnss_firmware:4.1:::::::*
	cpe:2.3:o:chcnav:p5e_gnss_firmware:4.2:::::::*

cpe:2.3:h:chcnav:p5e_gnss:-:*:*:*:*:*:*:*

History

21 Nov 2024, 07:03

Type	Values Removed	Values Added
References	~~() https://www.gov.il/en/Departments/faq/cve_advisories - Third Party Advisory~~	() https://www.gov.il/en/Departments/faq/cve_advisories - Third Party Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~5.3~~	v2 : unknown v3 : 5.7

Information

Published : 2022-07-18 13:15

Updated : 2024-11-21 07:03

NVD link : CVE-2022-30625

Mitre link : CVE-2022-30625

CVE.ORG link : CVE-2022-30625

JSON object : View

Products Affected

chcnav

p5e_gnss_firmware
p5e_gnss

CWE

CWE-548

Exposure of Information Through Directory Listing

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2022-30625", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cna@cyber.gov.il", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 1.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2022-07-18T13:15:10.193", "references": [{"url": "https://www.gov.il/en/Departments/faq/cve_advisories", "tags": ["Third Party Advisory"], "source": "cna@cyber.gov.il"}, {"url": "https://www.gov.il/en/Departments/faq/cve_advisories", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cna@cyber.gov.il", "description": [{"lang": "en", "value": "CWE-548"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Directory listing is a web server function that displays the directory contents when there is no index file in a specific website directory. A directory listing provides an attacker with the complete index of all the resources located inside of the directory. The specific risks and consequences vary depending on which files are listed and accessible."}, {"lang": "es", "value": "Directory listing es una funci\u00f3n del servidor web que muestra el contenido del directorio cuando no se presenta ning\u00fan archivo de \u00edndice en un directorio espec\u00edfico del sitio web. Un listado de directorios proporciona a un atacante el \u00edndice completo de todos los recursos ubicados dentro del directorio. Los riesgos y las consecuencias espec\u00edficas var\u00edan en funci\u00f3n de los archivos listados y accesibles"}], "lastModified": "2024-11-21T07:03:03.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:chcnav:p5e_gnss_firmware:4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64FE8B40-946C-4D67-A3BF-BEDB5E3C3502"}, {"criteria": "cpe:2.3:o:chcnav:p5e_gnss_firmware:4.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B26293DB-77D5-4417-B72C-6EEDFE6151D5"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:chcnav:p5e_gnss:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "56783F0F-85AA-4B6F-BC24-3F7659A86567"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cna@cyber.gov.il"}