Vvveb Directory Listing Information Disclosure Vulnerability

A directory listing information disclosure vulnerability has been identified in Vvveb versions prior to 1.0.8.3. This vulnerability allows unauthenticated attackers to enumerate files and directories by accessing multiple paths that lack proper index directives in .htaccess files. Exploitation of this vulnerability enables access to directories such as admin asset paths, plugins, themes, and media folders, where attackers can view filenames, file sizes, modification timestamps, and unrendered admin templates containing sensitive route maps.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information, including file names, sizes, modification dates, and unrendered admin templates with critical route maps.

Remediation

Users can update to Vvveb version 1.0.8.3 or later, where this vulnerability has been fixed.