CVE-2022-1439

MEDIUMNuclei

Reflected XSS on demo.microweber.org/demo/module/ in microweber/microweber

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-1439 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working, you might need to press "tab" but there is probably a paylaod that runs without user interaction.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Dec 20, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

3
ProductSourceVersion range

microweber

Browse microweber / microweber
VulnCheckVersion data not supplied

microweber/microweber

Browse microweber / microweber/microweber
CVE ListBefore 1.2.15affected

microweber/microweber

Browse Packagist / microweber/microweber
GitHub AdvisoryBefore 1.2.15 · Fixed in 1.2.15affected

Nuclei templates

1
ProjectDiscoveryMEDIUMMicroweber <1.2.15 - Cross-Site ScriptingCVSS 6.1

Microweber prior to 1.2.15 contains a reflected cross-site scripting vulnerability. An attacker can execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.

Remediation

Upgrade to Microweber CMS version 1.2.15 or later, which includes proper input sanitization to mitigate the XSS vulnerability.

WeaknessesCWE-79
Authorspikpikcu
Template tagscvecve2022microweberxsshuntrvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*
Shodan: http.favicon.hash:780351152
Shodan: http.html:"microweber"
FOFA: body="microweber"
FOFA: icon_hash=780351152
https://huntr.dev/bounties/86f6a762-0f3d-443d-a676-20f8496907e0/ https://huntr.dev/bounties/86f6a762-0f3d-443d-a676-20f8496907e0 https://github.com/microweber/microweber/commit/ad3928f67b2cd4443f4323d858b666d35a919ba8 https://nvd.nist.gov/vuln/detail/CVE-2022-1439 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

4