Description (CNA)
Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET request exploiting the failure of normalize_path() to strip traversal sequences, disclosing sensitive files such as environment configuration files containing credentials and system files.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| microweber / microweber | affected 0 through 2.0.20 |
CWE
CWE-22
References
- https://github.com/microweber/microweber/pull/1181
- https://www.vulncheck.com/advisories/microweber-cms-path-traversal-via-servestaticfilecontroller
ADP enrichment
No English description supplied.