CWE-548 (通过目录枚举导致的信息暴露) — Vulnerability Class 47

CWE-548 represents an information exposure weakness where a software product inappropriately reveals a directory listing, effectively indexing all resources contained within a specific folder. This vulnerability is typically exploited by attackers who manually navigate to the affected URL or use automated scripts to enumerate sensitive files, such as configuration backups, source code, or internal documents, without requiring authentication. By exposing this metadata, organizations inadvertently provide adversaries with valuable intelligence for further attacks, including credential harvesting or targeted exploitation of known vulnerabilities. To prevent this, developers must explicitly disable directory indexing on web servers and configure access control lists to restrict unauthorized browsing. Additionally, implementing proper authentication mechanisms and regularly auditing web server configurations ensures that only authorized users can access specific resources, thereby mitigating the risk of unintended data disclosure.