Medium severity · published Nov 9, 2020
CVE-2020-23139
Microweber 1.1.18 is affected by broken authentication and session management
5.5
CVSS
0.3%
EPSS
No
On KEV
Description
Microweber 1.1.18 is affected by broken authentication and session management. Local session hijacking may occur, which could result in unauthorized access to system data or functionality, or a complete system compromise.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
Microweber · Microweber
1.1.18 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-23139
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-23139
Third Party Advisory
https://gist.github.com/virendratiwari03/9fdebe4d0b379d1996238b535add56d6
More from Microweber
9.8
CVE-2023-1877
Command Injection in microweber/microweber
9.8
CVE-2022-2368
Authentication Bypass by Spoofing in microweber/microweber
9.8
CVE-2022-0895
Static Code Injection in microweber/microweber
9.8
CVE-2020-23138
An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page
8.8
CVE-2023-49052
File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the created forms component