In short
- CVE-2022-1439 is a MEDIUM (CVSS 6.1) vulnerability affecting microweber/microweber, microweber (microweber).
- Chance of exploitation in the next 30 days (EPSS): 3.3%, higher than 88.4% of all vulnerabilities.
- Fix: update to 1.2.15 or later.
Description
Microweber prior to 1.2.15 is vulnerable to reflected cross-site scripting on demo.microweber.org/demo/module/. This allows the execution of arbitrary JavaScript as the attacked user.
NVD description
Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working, you might need to press "tab" but there is probably a paylaod that runs without user interaction.
More vulnerabilities in microweber/microweber
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free