PT-2020-15545 · Microweber · Microweber

Virendratiwari03 · Published 2020-11-09 · Updated 2020-11-20 · CVE-2020-23138

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microweber version 1.1.18

Description An unrestricted file upload vulnerability was discovered in the Microweber admin account page. An attacker can upload PHP code or any extension (e.g., .exe) to the web server by providing image data and the image/jpeg content type with a .php extension.

Recommendations For Microweber version 1.1.18, consider restricting file uploads to only allowed extensions and validating the content type of uploaded files to prevent exploitation. As a temporary workaround, restrict access to the admin account page until a patch is available.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-23138

Affected Products

Microweber

References · 6

• https://osv.dev/vulnerability/CVE-2020-23138 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-23138 · Security Note
• https://gist.github.com/virendratiwari03/800f96271f22c0c2f5aea126c7f1f170 · Note
• https://t.me/cibsecurity/16039 · Telegram Post
• https://t.me/cvenotify/5897 · Telegram Post
• https://gist.github.com/virendratiwari03/0918aaba97eba31666630996ab3aeec3 · Note