Host Header Injection Vulnerability in Microweber Web Application by Microweber
CVE-2022-33012

8.8HIGH

Key Information:

Vendor
Microweber
Status
Microweber
Vendor
CVE Published:
22 November 2022

Summary

A vulnerability in Microweber v1.2.15 allows attackers to exploit host header injection to perform account takeover. By manipulating the host header, an attacker can trigger a password reset process that redirects victims to a malicious site, enabling unauthorized access to accounts.

References

https://github.com/swisskyrepo/PayloadsAllTheThings/tree/...
https://www.pethuraj.com/blog/how-i-earned-800-for-host-h...
https://github.com/microweber/microweber

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.