GitHub Advisoryadvisory · Packagist

GHSA-x28w-hvwc-mp75 Static Code Injection in Microweber

HIGH Published 2022-03-11 Modified 2022-03-25 Official page ↗

Aliases: CVE-2022-0895
Ecosystem: Packagist
Packages: microweber/microweber
Severity: High
CVSS vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H
Weaknesses: CWE-94, CWE-96
Reviewed: 2022-03-11

Affected packages

• Packagist microweber/microweber: < 1.3 → fixed in 1.3

Description

Microweber is a new generation CMS with drag and drop. Prior to version 1.3, Microweber is vulnerable to static code injection.

Related

Alias · CVE (1)

CVE-2022-0895 Static Code Injection in GitHub repository microweber/microweber prior to 1.3. vulnerability

Weakness · CWE (2)

CWE-94 Improper Control of Generation of Code weakness
CWE-96 Improper Neutralization of Directives in Statically Saved Code weakness

References