medium6.1
CVE-2022-0698
Microweber vulnerable to cross-site scripting (XSS)
Impact
Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter. There was a patch released in the development branch but is not yet committed to the main branch.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | microweber/microweber | <= 1.3.1 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microweber | Microweber | Version 1.3.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://fluidattacks.com/advisories/garrix/
- https://github.com/microweber/microweber/
- https://github.com/advisories/GHSA-79gx-3fm8-qxqq
- https://nvd.nist.gov/vuln/detail/CVE-2022-0698
- https://fluidattacks.com/advisories/garrix
- https://github.com/microweber/microweber