Unrestricted Upload of File with Dangerous Type in Microweber · CVE-2022-0921 · GitHub Advisory Database · GitHub

Unrestricted Upload of File with Dangerous Type in Microweber

Moderate severity GitHub Reviewed Published Mar 12, 2022 to the GitHub Advisory Database • Updated Jan 27, 2023

Package

microweber/microweber (Composer)

Affected versions

< 1.2.12

Patched versions

1.2.12

Description

In Microweber prior to 1.2.12, a malicious actor may abuse the Backup/Restore feature to achieve Remote Code Execution.

References

Published by the National Vulnerability Database

Mar 11, 2022

Published to the GitHub Advisory Database Mar 12, 2022

Reviewed Mar 23, 2022

Last updated Jan 27, 2023

Severity

Moderate

6.7

/ 10

CVSS base metrics

Attack vector

Local

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H