PT-2022-13390 · Unknown · Microweber

Published 2022-02-23 · Updated 2022-03-02 · CVE-2022-0724

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions microweber/microweber versions prior to 1.3

Description The issue concerns insecure storage of sensitive information in the microweber/microweber GitHub repository. Specifically, versions prior to 1.3 do not strip images of EXIF data, which can expose information about users' locations, device hardware, and device software.

Recommendations For versions prior to 1.3, update to version 1.3 or later to resolve the issue. As a temporary workaround, consider removing EXIF data from images before uploading them to minimize the risk of information exposure.

Exploit

Fix

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

Related Identifiers

CVE-2022-0724

GHSA-J8CX-J9J2-F29W

Affected Products

Microweber

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0724.json · Exploit
• 🔥 https://huntr.dev/bounties/0cdc4a29-dada-4264-b326-8b65b4f11062 · Exploit
• https://github.com/microweber/microweber/commit/b592c86d2b927c0cae5b73b87fb541f25e777aa3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-0724 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0724 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j8cx-j9j2-f29w · Vendor Advisory
• https://github.com/microweber/microweber · Note
• https://t.me/cibsecurity/37938 · Telegram Post
• https://t.me/cvenotify/27200 · Telegram Post
• https://t.me/cvenotify/27591 · Telegram Post