GitHub Advisoryadvisory · Packagist

GHSA-582p-2fpg-x226 Microweber vulnerable to command injection

MEDIUM Published 2023-04-05 Modified 2023-04-06 Official page ↗
Aliases
CVE-2023-1877
Ecosystem
Packagist
Packages
microweber/microweber
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L
Weaknesses
CWE-77
Reviewed
2023-04-06

Affected packages

• Packagist microweber/microweber: < 1.3.3 → fixed in 1.3.3

Description

microweber/microweber prior to 1.3.3 is vulnerable to command injection in the "first name" field. This allows for server-side template injection, which can lead to arbitrary code execution.

Related

Alias · CVE (1)

  • CVE-2023-1877 Command Injection in GitHub repository microweber/microweber prior to 1.3.3. vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References