CVE-2020-23138: Malicious File Upload

Published Nov 9, 2020

Updated

An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page. An attacker can upload PHP code or any extension (eg- .exe) to the web server by providing image data and the image/jpeg content type with a .php extension.

Affected Software

1 affected component

Microweber Microweber=1.1.18

Event History

Nov 9, 2020

CVE Published

via MITRE·05:03 PM

Data Sourced

via MITRE·05:03 PM

Description

Frequently Asked Questions

What is the severity of CVE-2020-23138?

CVE-2020-23138 is considered a critical vulnerability due to its impact on the integrity of the server.

How does CVE-2020-23138 allow for file uploads?

CVE-2020-23138 allows an attacker to upload files by tricking the system into accepting PHP files as image/jpeg content types.

What are the potential consequences of exploiting CVE-2020-23138?

Exploiting CVE-2020-23138 can result in remote code execution on the server, leading to unauthorized access and control.

How do I fix CVE-2020-23138?

To fix CVE-2020-23138, update to a patched version of Microweber that addresses this file upload vulnerability.

Which version of Microweber is affected by CVE-2020-23138?

CVE-2020-23138 affects Microweber version 1.1.18.