GitHub Advisoryadvisory · Packagist

GHSA-j8cx-j9j2-f29w Insecure Storage of Sensitive Information in Microweber

HIGH Published 2022-02-24 Modified 2022-02-24 Official page ↗
Aliases
CVE-2022-0724
Ecosystem
Packagist
Packages
microweber/microweber
Severity
High
Weaknesses
CWE-922
Reviewed
2022-02-24

Affected packages

• Packagist microweber/microweber: < 1.3 → fixed in 1.3

Description

Microweber prior to version 1.3 does not strip images of EXIF data, exposing information about users' locations, device hardware, and device software.

Related

Alias · CVE (1)

  • CVE-2022-0724 Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3. vulnerability

Weakness · CWE (1)

  • CWE-922 Insecure Storage of Sensitive Information weakness

References