CVE-2024-7912
Info Disclosure in Online Railway Reservation System Project Online Railway Reservation System 1.0
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2024-7912 is a medium-severity Exposure of Information Through Directory Listing (CWE-548) vulnerability in Online Railway Reservation System Project Online Railway Reservation System. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique File and Directory Discovery (T1083); ranked in the top 47% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and CM-7 (Least Functionality) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-48753
Vulnerability Data
A vulnerability was found in CodeAstro Online Railway Reservation System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/assets/. The manipulation leads to exposure of information through directory listing. The attack can be…
more
initiated remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires secure baseline settings that disable directory listing on servers and file shares.
Restricts unnecessary server features such as automatic directory indexing.
Enforces authorization decisions so that directory listings are never returned unless explicitly permitted.
Controls information flows so directory contents are not disclosed to unauthorized recipients.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened baselines and config management directly disable directory listing by default.
Lifecycle management includes applying secure configurations that would prevent directory exposure.
Vulnerability scanning can discover exposed directories so they can be remediated.
Least-privilege access rules can restrict who sees directory contents but do not address the listing feature itself.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Information access restriction directly prevents directory listings by enforcing need-to-know access controls on web resources.
Security testing in development and acceptance can detect and require remediation of exposed directory listings.
Network security measures such as disabling directory indexing on web servers reduce exposure of directory contents.
Secure development life cycle includes configuration hardening that disables directory listing in production web servers.
Application security requirements can mandate disabling directory indexing and enforcing proper access controls on web directories.
Secure system architecture principles include configuring web servers to prevent automatic directory listings.