Kurz gesagt
- CVE-2022-1439 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in microweber/microweber, microweber (microweber).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 3.3%, höher als bei 88.4% aller Schwachstellen.
- Abhilfe: auf 1.2.15 oder neuer aktualisieren.
Description
Microweber prior to 1.2.15 is vulnerable to reflected cross-site scripting on demo.microweber.org/demo/module/. This allows the execution of arbitrary JavaScript as the attacked user.
NVD description
Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working, you might need to press "tab" but there is probably a paylaod that runs without user interaction.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free