Microweber vulnerable to Cross-site Scripting
CVE-2021-32856

6.1MEDIUM

Key Information:

Vendor
Microweber
Status
Microweber
Vendor
CVE Published:
21 February 2023

Summary

Microweber is a drag and drop website builder and content management system. Versions 1.2.12 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. A fix was attempted in versions 1.2.9 and 1.2.12, but it is incomplete.

Affected Version(s)

microweber 1.2.12

References

https://securitylab.github.com/advisories/GHSL-2021-1005-...
https://github.com/microweber/microweber/commit/f3b86d59a...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.