PT-2014-3011 · Microweber · Microweber

Publicado 2014-05-12 · Atualizado 2014-05-13 · CVE-2013-5984

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microweber versions prior to 0.830

Description The issue allows remote attackers to delete arbitrary files by exploiting a directory traversal vulnerability. This is achieved by using a .. (dot dot) in the file parameter of the vulnerable delete.php file, located in the userfiles/modules/admin/backup directory.

Recommendations For versions prior to 0.830, update to version 0.830 or later to resolve the issue. As a temporary workaround, consider restricting access to the delete.php file in the userfiles/modules/admin/backup directory to minimize the risk of exploitation. Avoid using the file parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2013-5984

Produtos afetados

Microweber

Referências · 5

• 🔥 https://github.com/microweber/microweber/commit/9177d134960c24cb642d5cf3b42a1fba286219cc · Exploit
• 🔥 https://htbridge.com/advisory/HTB23175 · Exploit
• 🔥 http://packetstormsecurity.com/files/123652/Microweber-0.8-Arbitrary-File-Deletion.html · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5984 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-5984 · Nota de Segurança