Description
OpenBMCS 2.4 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive files by exploiting directory listing functionality. Attackers can browse directories like /debug/ and /php/ to discover configuration files, database credentials, and system information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OPEN BMCS | OpenBMCS | 2.4 | — |
References
- ExploitDB-50671 exploit
- Official Product Homepage product
- Zero Science Lab Disclosure (ZSL-2022-5695) third-party-advisory
- VulnCheck Advisory: OpenBMCS Directory Listing Information Disclosure third-party-advisory