PT-2021-20370 · Unknown · Microweber Cms

Nck0099 · Published 2021-10-19 · Updated 2021-10-25 · CVE-2021-33988

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Microweber CMS version 1.2.7

Description: A Cross Site Scripting (XSS) issue exists in the Login form, allowing a malicious user to execute Javascript by inserting code in the request form. This could potentially let attackers execute malicious scripts.

Recommendations: For Microweber CMS version 1.2.7, consider disabling the Login form until a patch is available to prevent potential exploitation. Restrict access to the Login form to minimize the risk of XSS attacks. Avoid using the Login form with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-33988

GHSA-W7X8-CQ7R-G5G9

Affected Products

Microweber Cms

References · 6

• 🔥 https://github.com/nck0099/osTicket/issues/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-33988 · Security Note
• https://osv.dev/vulnerability/GHSA-w7x8-cq7r-g5g9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33988 · Vendor Advisory
• https://github.com/microweber/microweber · Note
• https://t.me/cibsecurity/30805 · Telegram Post