Lucene search

GitHub Advisory DatabaseGHSA-FQCV-RFP6-WV92

HistoryJun 07, 2023 - 3:30 p.m.

Microweber Cross-site Scripting vulnerability

2023-06-0715:30:18

CWE-79

GitHub Advisory Database

github.com

microweber

cross-site scripting

vulnerability

stored

editing page

commit 42efa981a2239d042d910069952d6276497bdcf1

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

34.7%

JSON

Microweber 1.3.4 and prior is vulnerable to stored cross-site scripting via an alert on the Editing page. This issue is fixed in commit 42efa981a2239d042d910069952d6276497bdcf1.

Affected configurations

Vulners

Node

microwebermicroweberRange≤1.3.4

CPENameOperatorVersion
microweber/microweberle1.3.4

CPE	Name	Operator	Version
	microweber/microweber	le	1.3.4

References

github.com/advisories/GHSA-fqcv-rfp6-wv92

github.com/microweber/microweber/commit/42efa981a2239d042d910069952d6276497bdcf1

huntr.dev/bounties/d00686b0-f89a-4e14-98d7-b8dd3f92a6e5

nvd.nist.gov/vuln/detail/CVE-2023-3142