CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2020-28337

A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature. To exploit the vulnerability, an attacker must have the credentials of an administrative user, upload a maliciously constructed ZIP file with file paths including relative paths (i.e., ../../), move this file into the backup directory, and execute a restore on this file.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.141

EPSS Ranking 94.0%

CVSS Severity

CVSS v3 Score 7.2

CVSS v2 Score 6.5

References

Products affected by CVE-2020-28337

Microweber » Microweber » Version: N/A

cpe:2.3:a:microweber:microweber:-
Microweber » Microweber » Version: 0.750

cpe:2.3:a:microweber:microweber:0.750
Microweber » Microweber » Version: 0.8

cpe:2.3:a:microweber:microweber:0.8
Microweber » Microweber » Version: 0.823

cpe:2.3:a:microweber:microweber:0.823
Microweber » Microweber » Version: 0.830

cpe:2.3:a:microweber:microweber:0.830
Microweber » Microweber » Version: 0.9.346

cpe:2.3:a:microweber:microweber:0.9.346
Microweber » Microweber » Version: 0.93

cpe:2.3:a:microweber:microweber:0.93
Microweber » Microweber » Version: 0.931

cpe:2.3:a:microweber:microweber:0.931
Microweber » Microweber » Version: 0.934

cpe:2.3:a:microweber:microweber:0.934
Microweber » Microweber » Version: 0.95

cpe:2.3:a:microweber:microweber:0.95
Microweber » Microweber » Version: 0.951

cpe:2.3:a:microweber:microweber:0.951
Microweber » Microweber » Version: 1.0.3

cpe:2.3:a:microweber:microweber:1.0.3
Microweber » Microweber » Version: 1.0.4

cpe:2.3:a:microweber:microweber:1.0.4
Microweber » Microweber » Version: 1.0.5

cpe:2.3:a:microweber:microweber:1.0.5
Microweber » Microweber » Version: 1.0.6

cpe:2.3:a:microweber:microweber:1.0.6
Microweber » Microweber » Version: 1.0.7

cpe:2.3:a:microweber:microweber:1.0.7
Microweber » Microweber » Version: 1.0.8

cpe:2.3:a:microweber:microweber:1.0.8
Microweber » Microweber » Version: 1.1

cpe:2.3:a:microweber:microweber:1.1
Microweber » Microweber » Version: 1.1.18

cpe:2.3:a:microweber:microweber:1.1.18
Microweber » Microweber » Version: 1.1.20

cpe:2.3:a:microweber:microweber:1.1.20
Microweber » Microweber » Version: 1.1.3

cpe:2.3:a:microweber:microweber:1.1.3

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2020-28337

Products

Pricing

Contact Us