PT-2020-15548 · Microweber · Microweber

Virendratiwari03 · Published 2020-11-09 · Updated 2020-11-20 · CVE-2020-23140

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Microweber version 1.1.18

Description The issue concerns insufficient session expiration. When a user changes their password, both the session for the email change and old sessions on other browsers or devices remain active and do not expire.

Recommendations For Microweber version 1.1.18, as a temporary workaround, consider implementing a manual session expiration mechanism after password changes to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2020-23140

Affected Products

Microweber

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-23140 · Security Note
• https://osv.dev/vulnerability/CVE-2020-23140 · Vendor Advisory
• https://t.me/cibsecurity/16040 · Telegram Post
• https://gist.github.com/virendratiwari03/bddafb3cd82dde8202bd056d340d3e36 · Note