CVE-2021-36461

Published: Jul 15, 2022Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious code, user.ini.

Affected (1)

Products: Microweber: Microweber

Microweber

1 product

Microweber

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Microweber Microweber	Version 1.1.3

Related CWEs

CWE-434

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (2)

https://github.com/microweber/microweber/issues/751

Source: cve@mitre.org

ExploitIssue TrackingThird Party Advisory

https://github.com/microweber/microweber/issues/751

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingThird Party Advisory

Timeline

No history available yet.