GitHub Advisoryadvisory · Packagist

GHSA-pmxg-w9c7-ffmq Microweber Discloses Sensitive Information

HIGH Published 2022-05-24 Modified 2023-08-22 Official page ↗
Aliases
CVE-2020-13405
Ecosystem
Packagist
Packages
microweber/microweber
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-306
Reviewed
2023-07-13

Affected packages

• Packagist microweber/microweber: < 1.1.20 → fixed in 1.1.20

Description

`userfiles/modules/users/controller/controller.php` in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a `/modules/ POST` request.

Related

Alias · CVE (1)

  • CVE-2020-13405 userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-306 Missing Authentication for Critical Functionality weakness

References