High severity · published Jul 15, 2022
CVE-2021-36461
An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious…
8.8
CVSS
0.9%
EPSS
No
On KEV
Description
An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious code, user.ini.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
Microweber · Microweber
1.1.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-36461
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-36461
Exploit
https://github.com/microweber/microweber/issues/751
More from Microweber
9.8
CVE-2023-1877
Command Injection in microweber/microweber
9.8
CVE-2022-2368
Authentication Bypass by Spoofing in microweber/microweber
9.8
CVE-2022-0895
Static Code Injection in microweber/microweber
9.8
CVE-2020-23138
An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page
8.8
CVE-2023-49052
File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the created forms component