CVE-2020-37082 | webERP 4.15.1 contains an unauthenticated file access vulner… | CVSS 9.8 CRITICAL

Description

webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentication. Attackers can directly access generated backup files in the companies/weberp/ directory by requesting the Backup_[timestamp].sql.gz file.

Metadata

CVE ID: CVE-2020-37082
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-02-01 13:16 UTC
Published: 2026-02-03 22:01 UTC
Last updated: 2026-03-05 01:27 UTC
Primary CWE: CWE-552
Files or Directories Accessible to External Parties
Vendor / Product: Weberp / webERP
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Weberp	webERP	—	4.15.1

Weakness (CWE)

CWE	Source	Description
CWE-552	cna	Files or Directories Accessible to External Parties

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.6	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References (4)

ExploitDB-48420 https://www.exploit-db.com/exploits/48420
Official webERP Vendor Homepage http://www.weberp.org
webERP SourceForge Project Page https://sourceforge.net/projects/web-erp/
VulnCheck Advisory: webERP 4.15.1 - Unauthenticated Backup File Access https://www.vulncheck.com/advisories/weberp-unauthenticated-backup-file-access