GHSA-pmxg-w9c7-ffmq

Microweber Discloses Sensitive Information

Source: GitHub Advisory Database (reviewed) High CVE-2020-13405

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	microweber/microweber	< 1.1.20	1.1.20

Details

As written in the advisory (Markdown source, shown as plain text).

`userfiles/modules/users/controller/controller.php` in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a `/modules/ POST` request.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-13405 advisory
https://github.com/microweber/microweber/commit/269320e0e0e06a1785e1a1556da769a34280b7e6 web
https://github.com/microweber/microweber package
https://rhinosecuritylabs.com/research/microweber-database-disclosure web