CVE-2020-23136
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability in Microweber v1.1.18 causes the user session not to expire after logout. This allows an attacker to reuse a valid session for unauthorized access.
Risk Assessment
The risk involves potential account takeover by an unauthorized party who gains access to the session, leading to data theft or content manipulation.
Recommendation
Immediately update Microweber to the latest version that fixes this vulnerability. Additionally, implement session invalidation upon logout.
Other vulnerabilities in Microweber
See all- CVE-2026-5696Medium
Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the 'group' parameter of the '/admin/settings' endpoint in the administration panel. A successful exploit allows an attacker to trick an authenticated user into executing malicious JavaScript code in their browser.
- CVE-2026-12198High
In Microweber up to 2.0.20, a path traversal vulnerability exists in the userfiles_path function of /api_nosession/thumbnail_img via manipulation of the cache_path_relative argument. The attack can be launched remotely and the exploit is publicly available.
- CVE-2024-40101Medium
A reflected XSS vulnerability exists in Microweber 2.0.15 and earlier in the '/search' endpoint. An unauthenticated remote attacker can inject arbitrary web script or HTML via the 'keywords' parameter.
Original NVD description (English source)
Microweber v1.1.18 is affected by no session expiry after log-out.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS