CVE-2022-3245 - Code Injection in display of tag title on saving tags in microweber/microweber

Back Back to CVE browser

MEDIUM

Code Injection in display of tag title on saving tags in microweber/microweber

Published Sep 20, 2022

6.1

MEDIUM

CVSS 3.1

EPSS 0.72%

Description

HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input.

Affected products

Vendor Microweber Product Microweber/microweber Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <1.3.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microweber

Microweber/microweber

n/a

Version	Status	Constraints
unspecified	affected	<1.3.2

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-79

Cross-site Scripting (XSS)

CWE-94

Code Injection

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6825
Advisory
https://github.com/advisories/GHSA-gm8c-w9cm-c445
Advisory
https://github.com/microweber/microweber/commit/f20abf30a1d9c1426c5fb757ac63998dc5b92bfc
x_refsource_MISCPatchThird Party Advisory
https://huntr.dev/bounties/747c2924-95ca-4311-9e69-58ee0fb440a0
x_refsource_CONFIRMExploitIssue TrackingPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-3245

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6825		Advisory
https://github.com/advisories/GHSA-gm8c-w9cm-c445		Advisory
https://github.com/microweber/microweber/commit/f20abf30a1d9c1426c5fb757ac63998dc5b92bfc		x_refsource_MISCPatchThird Party Advisory
https://huntr.dev/bounties/747c2924-95ca-4311-9e69-58ee0fb440a0		x_refsource_CONFIRMExploitIssue TrackingPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-3245