CVE-2020-28337: Path Traversal
A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature. To exploit the vulnerability, an attacker must have the credentials of an administrative user, upload a maliciously constructed ZIP file with file paths including relative paths (i.e., ../../), move this file into the backup directory, and execute a restore on this file.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-28337?
CVE-2020-28337 has been classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2020-28337?
To fix CVE-2020-28337, update Microweber to version 1.1.21 or later.
What systems are affected by CVE-2020-28337?
CVE-2020-28337 affects Microweber versions up to and including 1.1.20.
Who can exploit CVE-2020-28337?
Only authenticated users with administrative privileges can exploit CVE-2020-28337.
What kind of attack can be performed through CVE-2020-28337?
CVE-2020-28337 allows an authenticated attacker to execute arbitrary code via a directory traversal attack during the backup restore process.