MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module. The /admin/file/list.do endpoint lacks authentication controls and proper input validation, allowing remote attackers to enumerate directory contents on the server without any credentials.
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
Updated vendor and product to MRCMS, set affected version to 3.1.2, changed severity to HIGH, and marked as actively exploited.
Initial creation
