CVE-2023-49979

Controls information flows so directory contents are not disclosed to unauthorized recipients.

Lifecycle management includes applying secure configurations that would prevent directory exposure.

Vulnerability scanning can discover exposed directories so they can be remediated.

Least-privilege access rules can restrict who sees directory contents but do not address the listing feature itself.

Hardened baselines and config management directly disable directory listing by default.

Requiring formal authorization of every access request before rights are granted ensures that checks for required permissions are performed, preventing missing authorization checks from being introduced.

A.5.18's provisioning, review, revocation and activation steps (incl. owner approval, SoD, timely removal on role/termination change) directly stop exploitation of missing authorization checks by ensuring no actor receives or retains rights to resources they should not access; the bounded remainder is that it cannot stop missing-authorization defects inside the enforcement mechanism itself once rights have been granted (e.g. flawed code that ignores the rights table).

By requiring competent outsiders to verify that every function enforces the need-to-know principle, the control lowers the likelihood that missing authorization checks persist undetected.

A.5.8 integrates risk assessment, requirements elicitation and governance into the project lifecycle so that authorization needs can be identified and specified; it does not itself perform or enforce authorization checks, so the missing-authorization weakness can still be present and exploitable.

Network security measures such as disabling directory indexing on web servers reduce exposure of directory contents.

Security checkpoints and explicit authorization requirements in the design phase ensure that every sensitive function is paired with an access-control check, reducing missing-authorization defects.