The vulnerability in Census CSWeb 8.0.1 permits an unauthenticated attacker to access the "app/config" path via HTTP, exposing configuration files that may contain confidential secrets. This is a classic information disclosure flaw, classified as CWE‑200, which can be exploited by reaching the vulnerable endpoint without any authentication. The attacker can retrieve files that may reveal credentials, API keys, or other sensitive data, potentially compromising the entire application and surrounding infrastructure.

The affected system is Census CSWeb version 8.0.1. No other versions or vendors are reported as impacted. The vulnerability exists when the deployment exposes the "app/config" directory through an HTTP request path.

The scoring indicates a CVSS base of 9.3, denoting a critical severity. However, the EPSS score is below 1%, suggesting that automated exploitation is unlikely to be widespread. The vulnerability is not currently listed in the CISA KEV catalog, further indicating limited known exploitation. Attackers would need to send HTTP requests to the specific path, which is possible if the web server is not restricted, and no elevated privileges are required. The risk to confidentiality is high, while impact on integrity and availability is not directly addressed, but compromised secrets could lead to further attacks.