Microweber allows Unrestricted File Upload

2022-05-2417:18:12

Google

osv.dev

0.001 Low

EPSS

Percentile

20.4%

JSON

Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/load_module:users#edit-user=1 does not verify that the file extension (used with the Add Image option on the Edit User screen) corresponds to an image file.

CPENameOperatorVersion
microweber/microwebereq0.931
microweber/microwebereq0.9.346
microweber/microwebereq1.0.7
microweber/microwebereq0.951
microweber/microwebereq1.0.6
microweber/microwebereq0.934
microweber/microwebereq1.0.5
microweber/microwebereq1.1
microweber/microwebereq0.93
microweber/microwebereq1.0.3

Name	Operator	Version
microweber/microweber	eq	0.931
microweber/microweber	eq	0.9.346
microweber/microweber	eq	1.0.7
microweber/microweber	eq	0.951
microweber/microweber	eq	1.0.6
microweber/microweber	eq	0.934
microweber/microweber	eq	1.0.5
microweber/microweber	eq	1.1
microweber/microweber	eq	0.93
microweber/microweber	eq	1.0.3