CVE-2020-28337 - CVE House
Back to Database
Status published High CVE-2020-28337

A directory traversal issue in the Utils/Unzip module in Microweber...

Vulnerability Description

A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature. To exploit the vulnerability, an attacker must have the credentials of an administrative user, upload a maliciously constructed ZIP file with file paths including relative paths (i.e., ../../), move this file into the backup directory, and execute a restore on this file.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-28337

Credits & Attribution

No credits recorded in the NVD database.

References

More from microweber

View All →
CVE-2024-58289
Microweber 2.0.15 Stored Cross-Site Scripting via User Profile Fields
Medium 5.3
CVE-2023-6832
Business Logic Errors in microweber/microweber
Medium 6
CVE-2023-6599
Missing Standardized Error Handling Mechanism in microweber/microweber
Low 3.1
CVE-2023-6566
Business Logic Errors in microweber/microweber
Medium 5.9
CVE-2023-5976
Improper Access Control in microweber/microweber
Medium 4.6

Affected Vendor

Affected Software

microweber
Vulnerable Versions:
0

Timeline

Official Publish: February 15th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.