PT-2024-29387 · Unknown · Microweber

Xjzzzxx · Published 2024-08-05 · Updated 2024-08-07 · CVE-2024-41381

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions microweber version 2.0.16

Description The issue is related to a Cross Site Scripting (XSS) vulnerability. It affects the admin.php file located in the userfilesmodulessettings directory.

Recommendations For microweber version 2.0.16, consider restricting access to the admin.php file in the userfilesmodulessettings directory until a fix is available. As a temporary workaround, avoid using the vulnerable admin.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-41381

GHSA-H4XF-WX99-JMV4

Affected Products

Microweber

References · 6

• https://github.com/microweber/microweber/issues/1110 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-41381 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41381 · Security Note
• https://osv.dev/vulnerability/GHSA-h4xf-wx99-jmv4 · Vendor Advisory
• https://github.com/microweber/microweber · Note
• https://t.me/cvedetector/2481 · Telegram Post