CVE-2022-2777

MEDIUM6.6EPSS 0.14%

Microweber's title parameter in the body of POST request vulnerable to stored XSS

Published: 8/12/2022Modified: 11/8/2023

Description

In Microweber prior to v1.3.1, the title parameter in the body of POST request when creating/editing a category is vulnerable to stored cross-site scripting.

Affected packages (1)

Packagist/microweber/microweberfrom 0, < 1.3.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.6	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-2777
PATCHhttps://github.com/microweber/microweber
WEBhttps://github.com/microweber/microweber/commit/60eef7494211d1c458228c321e986edeaa401a58
WEBhttps://huntr.dev/bounties/13dd2f4d-0c7f-483e-a771-e1ed2ff1c36f