GitHub Advisoryadvisory · Packagist

GHSA-gmh3-x5w7-jg5m Microweber before v1.2.20 vulnerable to cross-site scripting

MEDIUM Published 2022-07-10 Modified 2022-07-20 Official page ↗
Aliases
CVE-2022-2353
Ecosystem
Packagist
Packages
microweber/microweber
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-352, CWE-79
Reviewed
2022-07-12

Affected packages

• Packagist microweber/microweber: < 1.2.20 → fixed in 1.2.20

Description

Prior to Microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery (CSRF), fetch contents from same-site and redirect a user.

Related

Alias · CVE (1)

  • CVE-2022-2353 Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request… vulnerability

Weakness · CWE (2)

  • CWE-352 Cross-Site Request Forgery weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References