Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS04OWZwLWo4djctcDgyaM4AAkuw
Microweber allows Unrestricted File Upload
Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/load_module:users#edit-user=1 does not verify that the file extension (used with the Add Image option on the Edit User screen) corresponds to an image file.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04OWZwLWo4djctcDgyaM4AAkuw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: 9 months ago
CVSS Score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Identifiers: GHSA-89fp-j8v7-p82h, CVE-2020-13241
References:
- https://nvd.nist.gov/vuln/detail/CVE-2020-13241
- https://gist.github.com/virendratiwari03/0af29841fdf27207eb3abc8f28d326f3
- https://github.com/advisories/GHSA-89fp-j8v7-p82h
Affected Packages
packagist:microweber/microweber
Dependent packages: 1Dependent repositories: 5
Downloads: 12,522 total
Affected Version Ranges: <= 1.1.18
No known fixed version
All affected versions: 0.9.346, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7