medium6.1
CVE-2022-3245
Microweber vulnerable to HTML Injection in create tag functionality
Impact
HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input. A patch is available on commit f20abf30a1d9c1426c5fb757ac63998dc5b92bfc and is anticipated to be part of version 1.3.2.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | microweber/microweber | <= 1.3.1 | 1.3.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microweber | Microweber | before 1.3.2 |