CVE-2020-13405 is a high-severity information disclosure vulnerability affecting Microweber versions prior to 1.1.20. An unauthenticated attacker can exploit a flaw in the user controller to disclose the entire user database via a crafted POST request. The vulnerability has a CVSS score of 7.5 (High) due to its network-based attack vector, low complexity, and high impact on confidentiality. While not listed in KEV, Nuclei templates exist for exploitation, and its EPSS score indicates a higher likelihood of exploitation compared to most CVEs, despite limited public discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.1.20CPE matchmatch criteria | cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.