名称: Exposure of Information Through Directory Listing

The product inappropriately exposes a directory listing with an index of all the resources located inside of the directory.

基本信息

引入方式

Implementation
Operation

适用平台

编程语言

类： Not Language-Specific (Undetermined)

常见后果

影响范围	影响	可能性
Confidentiality	Read Files or Directories 注意： Exposing the contents of a directory can lead to an attacker gaining access to source code or providing useful information for the attacker to devise exploits, such as creation times of files or any information that may be encoded in file names. The directory listing may also compromise private or confidential data.

观察示例

参考资料	描述
CVE-2023-37599	web interface is configured to allow directory listing of a module path

潜在缓解措施

Phases : Architecture and Design // System Configuration
Recommendations include restricting access to important directories or files by adopting a need to know requirement for both the document and server root, and turning off features such as Automatic Directory Listings that could expose private files and provide information that could be utilized by an attacker when formulating or conducting an attack.

检测方法

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
有效性 : High

漏洞映射说明

依据 : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
备注 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

参考资料

REF-1458

Directory Indexing
Web Application Security Consortium.
https://projects.webappsec.org/w/page/13246922/Directory%20Indexing

REF-1459

Directory indexing attacks
IBM.
https://www.ibm.com/docs/en/snips/4.6.0?topic=categories-directory-indexing-attacks

提交记录

名称	组织	日期	发布日期	Version
Anonymous Tool Vendor (under NDA)		2006-07-19 +00:00	2006-07-19 +00:00	Draft 3

修改记录

名称	组织	日期	备注
Eric Dalci	Cigital	2008-07-01 +00:00	updated Time_of_Introduction
	Veracode	2008-08-15 +00:00	Suggested OWASP Top Ten 2004 mapping
CWE Content Team	MITRE	2008-09-08 +00:00	updated Relationships, Other_Notes, Taxonomy_Mappings
CWE Content Team	MITRE	2008-10-14 +00:00	updated Other_Notes
CWE Content Team	MITRE	2009-10-29 +00:00	updated Description, Other_Notes
CWE Content Team	MITRE	2009-12-28 +00:00	updated Common_Consequences, Description
CWE Content Team	MITRE	2010-02-16 +00:00	updated Taxonomy_Mappings
CWE Content Team	MITRE	2011-03-29 +00:00	updated Name
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2012-05-11 +00:00	updated Relationships
CWE Content Team	MITRE	2012-10-30 +00:00	updated Potential_Mitigations
CWE Content Team	MITRE	2014-06-23 +00:00	updated Relationships
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships
CWE Content Team	MITRE	2017-11-08 +00:00	updated Taxonomy_Mappings
CWE Content Team	MITRE	2018-03-27 +00:00	updated Relationships
CWE Content Team	MITRE	2020-02-24 +00:00	updated Name, Relationships
CWE Content Team	MITRE	2021-10-28 +00:00	updated Relationships
CWE Content Team	MITRE	2023-04-27 +00:00	updated Detection_Factors, Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-04-03 +00:00	updated Description, Diagram, References
CWE Content Team	MITRE	2025-12-11 +00:00	updated Applicable_Platforms, Relationships, Weakness_Ordinalities
CWE Content Team	MITRE	2026-04-30 +00:00	updated Observed_Examples

CWE-548 详情

CWE-548