LiveActive security incident?Get immediate response
CVE Record

CVE-2020-23138: An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page.

An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page. An attacker can upload PHP code or any extension (eg- .exe) to the web server by providing image data and the image/jpeg content type with a .php extension.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2020-23138 describes an unrestricted file upload issue in the Microweber 1.1.18 admin account page. The source says attackers can upload PHP code or other extensions while presenting the upload as image/jpeg data. If exploitable in a real deployment, this could threaten the web server, but public severity scoring and fix details are not provided.

Executive priority

Treat this as a priority for any Microweber 1.1.18 deployment, especially internet-facing systems. The potential impact is serious, but the evidence bundle lacks active exploitation and patch specifics.

Technical view

The CVE record states that Microweber 1.1.18 allowed files with executable extensions, including .php, to be uploaded through the admin account page by using image-like data and an image/jpeg content type. The bundle does not provide CVSS, CWE mapping, authentication details, affected-version range beyond 1.1.18, or vendor remediation information.

Likely exposure

Exposure is most likely where Microweber 1.1.18 is deployed and the admin account page is reachable. The source bundle does not prove exposure for other Microweber versions or for unauthenticated users.

Exploitation context

The source bundle describes the upload behavior but does not cite active exploitation, CISA KEV listing, public weaponization beyond the linked reports, or observed attacks. KEV is false in the provided data.

Researcher notes

Key gaps are authentication requirements, exact affected version range, CVSS, CWE classification, patch reference, and whether uploaded PHP is reachable and executable by default. Do not assume broader product impact without vendor confirmation.

Mitigation direction

  • Check Microweber vendor guidance for fixed versions or patches.
  • Restrict admin account page access to trusted users and networks.
  • Disable execution in user-upload directories where operationally feasible.
  • Review upload controls for extension and MIME validation weaknesses.
  • Monitor web roots for unexpected executable files.

Validation and detection

  • Inventory Microweber deployments and confirm exact versions.
  • Identify whether any instance runs Microweber 1.1.18.
  • Review admin account page exposure from internet-facing paths.
  • Inspect upload directories for unexpected executable extensions.
  • Check web server configuration for script execution in upload paths.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

File access behavior lookup

The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-23138 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.