PT-2023-32038 · Unknown · Microweber

Published 2023-09-29 · Updated 2023-10-02 · CVE-2023-5318

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions microweber/microweber versions prior to 2.0

Description The issue concerns the use of hard-coded credentials in the GitHub repository microweber/microweber. A patch is available and is anticipated to be part of version 2.0.

Recommendations For versions prior to 2.0, update to version 2.0 or later to resolve the issue. At the moment, there is no information about other mitigation measures for this vulnerability.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2023-5318

GHSA-R657-3WQH-G2X9

Affected Products

Microweber

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5318.json · Exploit
• https://github.com/microweber/microweber/commit/c48b34dfd6cae7a55b452280d692dc62512574b0 · Patch
• https://osv.dev/vulnerability/CVE-2023-5318 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r657-3wqh-g2x9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5318 · Security Note
• https://github.com/microweber/microweber · Note
• https://t.me/cibsecurity/71358 · Telegram Post
• https://huntr.dev/bounties/17826bdd-8136-48ae-afb9-af627cb6fd5d · Note
• https://twitter.com/CVEnew/status/1707923584575033711 · Twitter Post