GHSA-pmxg-w9c7-ffmq

ghsaUSosv

Microweber Discloses Sensitive Information

view advisory published 2022-05-24Licence: CC-BY-4.0

`userfiles/modules/users/controller/controller.php` in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a `/modules/ POST` request.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-13405US	high7.5OT high	13.6% (96th)	Exploit	2020-07-16
userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST request.

references

External citations — patches, advisories, analysis.

https://github.com/microweber/microweberPACKAGE
https://github.com/microweber/microweber/commit/269320e0e0e06a1785e1a1556da769a34280b7e6WEB
https://nvd.nist.gov/vuln/detail/CVE-2020-13405ADVISORY
https://rhinosecuritylabs.com/research/microweber-database-disclosureWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan