Security Resilience

CWE · MITRE source

CWE-548Exposure of Information Through Directory Listing

Abstraction: Variant · CVEs in our corpus: 60

The product inappropriately exposes a directory listing with an index of all the resources located inside of the directory.

Last updated: 15 October 2026 14:21 UTC

OWASP Top 10 for Web (2025)

This weakness contributes to A01:2025 Broken Access Control.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • SC-30 Concealment and Misdirection
  • SC-38 Operations Security
  • AU-13 Monitoring for Information Disclosure
  • PR.PS-01
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls PROPOSED for this weakness (3)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control Title Family Why it addresses this CWE
SC-30Concealment and MisdirectionSCDirectory listings and resource enumeration can be suppressed or populated with misleading entries.
SC-38Operations SecuritySCReduces exposure via directory listings or accessible files when OPSEC restricts visibility of key organizational resources.
AU-13Monitoring for Information DisclosureAUDetects information exposure through directory listings as unauthorized disclosure.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2020-8161 6.78.60.03362020-07-02
CVE-2017-6045 6.27.50.01682017-06-21
CVE-2018-10590 6.27.50.01662018-05-15
CVE-2018-14785 6.27.50.02132018-08-10
CVE-2018-16493 6.27.50.01762019-02-01
CVE-2019-5415 6.27.50.01642019-03-21
CVE-2021-27505 6.17.50.01082022-05-13
CVE-2021-21528 6.07.50.00992021-11-12
CVE-2023-51948 6.07.50.00712024-01-19
CVE-2023-49979 6.07.50.00752024-03-21
CVE-2022-50788 6.07.50.00832025-12-30
CVE-2024-22082 5.97.50.00632024-03-20
CVE-2024-2340 5.95.30.28002024-04-09
CVE-2021-47718 5.97.50.00552025-12-09
CVE-2026-22860 5.97.50.00692026-02-18
CVE-2025-2038 5.87.30.00632025-03-06
CVE-2025-4909 5.87.30.00562025-05-19
CVE-2020-36921 5.87.50.00432026-01-06
CVE-2025-32750 5.87.50.00352026-05-20
CVE-2025-28170 5.77.60.00302025-07-29
CVE-2020-7858 5.36.80.01062021-04-22
CVE-2025-61685 5.26.50.00582025-10-03
CVE-2024-450965.16.50.00372024-09-05
CVE-2020-15081 4.85.30.01652020-07-02
CVE-2019-5437 4.75.30.01312019-05-10