PT-2022-21645 · Unknown · Microweber

Phoenix · Published 2022-11-22 · Updated 2022-11-28 · CVE-2022-33012

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microweber version 1.2.15

Description The issue allows attackers to perform an account takeover via a host header injection attack. This enables unauthorized access to user accounts, potentially leading to data breaches or other malicious activities.

Recommendations For Microweber version 1.2.15, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to sensitive account settings to minimize the risk of exploitation.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2022-33012

GHSA-RP7F-FHM8-9HPF

Affected Products

Microweber

References · 8

• 🔥 https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Account%20Takeover#account-takeover-through-password-reset-poisoning · Exploit
• 🔥 https://blog.jitendrapatro.me/cve-2022-33012-account-takeover-through-password-reset-poisoning · Exploit
• https://osv.dev/vulnerability/GHSA-rp7f-fhm8-9hpf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-33012 · Security Note
• https://osv.dev/vulnerability/CVE-2022-33012 · Vendor Advisory
• https://github.com/microweber/microweber · Note
• https://pethuraj.com/blog/how-i-earned-800-for-host-header-injection-vulnerability · Note
• https://t.me/cibsecurity/53335 · Telegram Post