Static Code Injection in Microweber · CVE-2022-0895 · GitHub Advisory Database · GitHub

Static Code Injection in Microweber

High severity GitHub Reviewed Published Mar 11, 2022 to the GitHub Advisory Database • Updated Jan 27, 2023

Package

microweber/microweber (Composer)

Affected versions

< 1.3

Patched versions

1.3

Description

Microweber is a new generation CMS with drag and drop. Prior to version 1.3, Microweber is vulnerable to static code injection.

References

Published by the National Vulnerability Database

Mar 10, 2022

Published to the GitHub Advisory Database Mar 11, 2022

Reviewed Mar 11, 2022

Last updated Jan 27, 2023

Severity

High

7.7

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

High

Privileges required

Low

User interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

High

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H