En bref
- CVE-2020-28337 est une vulnérabilité ÉLEVÉE (CVSS 7.2) touchant microweber/microweber, microweber (microweber).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 16.6%, plus élevée que 97.0% des vulnérabilités.
- Correctif : mettre à jour vers 1.2.3 ou plus récent.
Description
A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature. To exploit the vulnerability, an attacker must have the credentials of an administrative user, upload a maliciously constructed ZIP file with file paths including relative paths (i.e., ../../), move this file into the backup directory, and execute a restore on this file.
NVD description
A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature. To exploit the vulnerability, an attacker must have the credentials of an administrative user, upload a maliciously constructed ZIP file with file paths including relative paths (i.e., ../../), move this file into the backup directory, and execute a restore on this file.
Autres vulnérabilités de microweber/microweber
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free