PT-2022-21312 · Unknown · Microweber

Published 2022-09-20 · Updated 2022-09-21 · CVE-2022-3242

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions microweber/microweber versions prior to 1.3.2

Description The issue concerns code injection in the microweber/microweber GitHub repository. It is also described as an HTML injection vulnerability that can be exploited by an attacker to redirect users to a malicious site.

Recommendations For versions prior to 1.3.2, update to version 1.3.2 or apply the patch available at commit 68f0721571653db865a5fa01c7986642c82e919c to resolve the issue.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2022-3242

GHSA-232P-59MG-F98P

Affected Products

Microweber

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3242.json · Exploit
• 🔥 https://huntr.dev/bounties/3e6b218a-a5a6-40d9-9f7e-5ab0c6214faf · Exploit
• https://github.com/microweber/microweber/commit/68f0721571653db865a5fa01c7986642c82e919c · Patch
• https://osv.dev/vulnerability/GHSA-232p-59mg-f98p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3242 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3242 · Vendor Advisory
• https://github.com/microweber/microweber · Note
• https://t.me/cibsecurity/50134 · Telegram Post