medium6.1
CVE-2024-40101
Microweber Reflected Cross-site scripting (XSS) vulnerability
Impact
A Reflected Cross-site scripting (XSS) vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote attackers to inject arbitrary web script or HTML via the 'keywords' parameter.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | microweber/microweber | < 2.0.16 | 2.0.16 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microweber | Microweber | through 2.0.15 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/microweber/microweber/commit/0dede6886c6df3d1f31c4f4e3ba1ab4a336fbf79
- https://seclists.org/fulldisclosure/2024/Aug/1
- http://seclists.org/fulldisclosure/2024/Aug/1
- https://github.com/advisories/GHSA-m99v-mmg2-66vf
- https://nvd.nist.gov/vuln/detail/CVE-2024-40101
- http://microweber.com