PT-2022-13567 · Unknown · Microweber

Published 2022-03-15 · Updated 2022-03-22 · CVE-2022-0968

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions microweber versions prior to 1.2.12

Description The microweber application has an issue where large characters can be inserted into the input field first & last name, potentially allowing attackers to cause a Denial of Service (DoS) via a crafted HTTP request. It is suggested that the input field should be limited to 50 characters or a maximum of 100 characters to prevent this issue.

Recommendations For versions prior to 1.2.12, update to version 1.2.12 or later to resolve the issue. As a temporary workaround, consider limiting the input field first & last name to 50 characters or a maximum of 100 characters to minimize the risk of exploitation.

Exploit

Fix

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2022-0968

GHSA-5FXV-XX5P-G2FV

Affected Products

Microweber

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0968.json · Exploit
• 🔥 https://huntr.dev/bounties/97e36678-11cf-42c6-889c-892d415d9f9e · Exploit
• https://github.com/microweber/microweber/commit/80e39084729a57dfe749626c3b9d35247a14c49e · Patch
• https://osv.dev/vulnerability/GHSA-5fxv-xx5p-g2fv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0968 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0968 · Vendor Advisory
• https://github.com/microweber/microweber · Note