GHSA-79gx-3fm8-qxqq

Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-79gx-3fm8-qxqq/GHSA-79gx-3fm8-qxqq.json
Aliases
  • CVE-2022-0698
Published
2022-11-25T18:30:25Z
Modified
2023-01-31T02:34:45.631590Z
Details

Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter. There was a patch released in the development branch but is not yet committed to the main branch.

References

Affected packages

Packagist / microweber/microweber

microweber/microweber

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0
Last affected
1.3.1

Affected versions

0.*

0.9.346
0.93
0.931
0.934
0.951

1.*

1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.1

v1.*

v1.2.10
v1.2.11
v1.2.12
v1.2.13
v1.2.14
v1.2.15
v1.2.16
v1.2.17
v1.2.18
v1.2.19
v1.2.20
v1.2.21
v1.2.3
v1.2.4
v1.2.5
v1.2.6
v1.2.7
v1.2.8
v1.2.9
v1.3.0
v1.3.1