Detections
Analytics

Magento Directory Listing

medium Web App Scanning Plugin ID 98986

Language:

Synopsis

Magento Directory Listing

Description

The scanner has detected publicly accessible directory listings on the Magento web application. This may expose sensitive information to an attacker which may allow for further exploitation techniques to be leveraged, possibly leading to sensitive information leakage or a compromise of the target server.

Solution

Ensure requests to sensitive resources and directories are blocked using .htaccess files or by using a WAF for example.

See Also

https://docs.magento.com/m1/ce/user_guide/magento/magento-security-best-practices.html

Plugin Details

Severity: Medium

ID: 98986

Type: remote

Published: 3/20/2020

Updated: 11/22/2023

Scan Template: basic, full, pci, scan

Risk Information

VPR

Risk Factor: Low

Score: 1.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: Tenable

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS Score Source: Tenable

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS Score Source: Tenable

Reference Information