Lucene search

@huntrdevCVE-2022-0930

HistoryMar 12, 2022 - 2:15 p.m.

CVE-2022-0930

2022-03-1214:15:07

CWE-434

CWE-79

@huntrdev

web.nvd.nist.gov

cve-2022-0930

file upload

filter bypass

stored xss

github

microweber

security vulnerability

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

21.4%

JSON

File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.

Affected configurations

Nvd

Node

microwebermicroweberRange<1.2.12

VendorProductVersionCPE
microwebermicroweber*cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microweber	microweber	*	cpe:2.3:a:microweber:microweber::::::::

CNA Affected

[
  {
    "product": "microweber/microweber",
    "vendor": "microweber",
    "versions": [
      {
        "lessThan": "1.2.12",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/microweber/microweber/commit/33eb4cc0f80c1f86388c1862a8aee1061fa5d72e

huntr.dev/bounties/d184ce19-9608-42f1-bc3d-06ece2d9a993

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

21.4%

JSON

Related for CVE-2022-0930