Raw vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2024-28766 is a low-severity Exposure of Information Through Directory Listing (CWE-548) vulnerability in Ibm Security Directory Integrator. Its CVSS base score is 2.4 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique File and Directory Discovery (T1083); ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and CM-7 (Least Functionality) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-28766 affects IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0, where the software could disclose sensitive information about directory contents. This information exposure vulnerability, mapped to CWE-548, carries a CVSS v3.1 base score of 2.4 (AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) and was published on 2025-01-27.
Attackers with high privileges (PR:H) on an adjacent network (AV:A) can exploit this with low complexity (AC:L) and no user interaction (UI:N). Successful exploitation enables low-impact confidentiality disclosure (C:L) of directory contents, which could aid in further attacks against the system, without affecting integrity or availability.
IBM provides details on the vulnerability and mitigation in its security advisory at https://www.ibm.com/support/pages/node/7161444.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-25852
Vulnerability Data
IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 could disclose sensitive information about directory contents that could aid in further attacks against the system.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires secure baseline settings that disable directory listing on servers and file shares.
Restricts unnecessary server features such as automatic directory indexing.
Enforces authorization decisions so that directory listings are never returned unless explicitly permitted.
Controls information flows so directory contents are not disclosed to unauthorized recipients.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened baselines and config management directly disable directory listing by default.
Lifecycle management includes applying secure configurations that would prevent directory exposure.
Vulnerability scanning can discover exposed directories so they can be remediated.
Least-privilege access rules can restrict who sees directory contents but do not address the listing feature itself.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Information access restriction directly prevents directory listings by enforcing need-to-know access controls on web resources.
Security testing in development and acceptance can detect and require remediation of exposed directory listings.
Network security measures such as disabling directory indexing on web servers reduce exposure of directory contents.
Secure development life cycle includes configuration hardening that disables directory listing in production web servers.
Application security requirements can mandate disabling directory indexing and enforcing proper access controls on web directories.
Secure system architecture principles include configuring web servers to prevent automatic directory listings.