Insecure Storage of Sensitive Information in Microweber

MEDIUM 6.5CVE-2022-0724 · GHSA-j8cx-j9j2-f29w · Published 23/02/2022 · updated 17/06/2026

In short

CVE-2022-0724 is a MEDIUM (CVSS 6.5) vulnerability affecting microweber/microweber, microweber (microweber).
Chance of exploitation in the next 30 days (EPSS): 1.3%, higher than 71.5% of all vulnerabilities.
Fix: update to 1.3 or later.

Package	Affected versions	Patched versions
microweber/microweber Packagist	`< 1.3`	`1.3`
microweber microweber	`< 1.3`	`1.3`

Description

Microweber prior to version 1.3 does not strip images of EXIF data, exposing information about users' locations, device hardware, and device software.

NVD description

Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3.

References

nvd.nist.gov/vuln/detail/CVE-2022-0724 · ADVISORY
microweber/microweber commit b592c86 · WEB
microweber/microweber · PACKAGE
huntr.dev/bounties/0cdc4a29-dada-4264-b326-8b65b4f11062 · WEB

More vulnerabilities in microweber/microweber

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

microweber/microweber

Packagist

< 1.3

1.3

microweber

< 1.3

1.3

More vulnerabilities in microweber/microweber

See all →