PT-2022-13418 · Unknown · Microweber

Published 2022-02-26 · Updated 2023-08-02 · CVE-2022-0762

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions microweber versions prior to 1.3

Description The issue concerns business logic errors and incorrect authorization in the microweber repository. This allows users to add deleted products to a cart and buy them, exposing resources to the wrong sphere.

Recommendations For versions prior to 1.3, update to version 1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the cart functionality for deleted products until a patch is available. Avoid using the affected repository until the issue is resolved.

Exploit

Fix

Incorrect Authorization

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-863

CWE-668

Related Identifiers

CVE-2022-0762

GHSA-5875-P652-2PPM

Affected Products

Microweber

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0762.json · Exploit
• 🔥 https://huntr.dev/bounties/125b5244-5099-485e-bf75-e5f1ed80dd48 · Exploit
• https://github.com/microweber/microweber/commit/76361264d9fdfff38a1af79c63141455cc4d36e3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-0762 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0762 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5875-p652-2ppm · Vendor Advisory
• https://github.com/microweber/microweber · Note
• https://t.me/cvenotify/54880 · Telegram Post
• https://t.me/cvenotify/27434 · Telegram Post
• https://t.me/cibsecurity/38159 · Telegram Post