CVE-2020-28337

Katalog CVE

CVSS 7.2 · High EPSS 16,6%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada microweber. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature. To exploit the vulnerability, an attacker must have the credentials of an administrative user, upload a maliciously constructed ZIP file with file paths including relative paths (i.e., ../../), move this file into the backup directory, and execute a restore on this file.

Rincian

Terbit di NVD

15 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

16,6% peluang dieksploitasi; lebih tinggi dari 96,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/microweber/microweber/commit/777ee9c3e7519eb3672c79ac41066175b2001b50 patch · advisory pihak ketiga
• https://sl1nki.page/blog/2021/02/01/microweber-zip-slip exploit · patch · advisory pihak ketiga
• http://packetstormsecurity.com/files/162514/Microweber-CMS-1.1.20-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
• https://sl1nki.page/advisories/CVE-2020-28337 advisory pihak ketiga