high7.8
CVE-2020-13241
Microweber allows Unrestricted File Upload
Impact
Microweber 1.1.18 allows Unrestricted File Upload because `admin/view:modules/load_module:users#edit-user=1` does not verify that the file extension (used with the Add Image option on the Edit User screen) corresponds to an image file.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | microweber/microweber | <= 1.1.18 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microweber | Microweber | Version 1.1.18 |