CVE-2020-37082
webERP 4.15.1 - Unauthenticated Backup File Access
- State
- Published
- Severity
- 8.6 High
- Published
- Feb 3, 2026
- Updated
- Mar 5, 2026
- Reserved
- Feb 1, 2026
Description
webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentication. Attackers can directly access generated backup files in the companies/weberp/ directory by requesting the Backup_[timestamp].sql.gz file.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-552 Files or Directories Accessible to External Parties
Affected Products
| Product | Versions |
|---|---|
webERPWeberp |
|
References
- ExploitDB-48420exploit
- Official webERP Vendor Homepageproduct
- webERP SourceForge Project Pageproduct
- VulnCheck Advisory: webERP 4.15.1 - Unauthenticated Backup File Accessthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.