XSS Vulnerability in Microweber by Microweber
CVE-2024-41380

6.1MEDIUM

Key Information:

Vendor

Microweber

Status
Microweber
Vendor
CVE Published:
5 August 2024

What is CVE-2024-41380?

Microweber 2.0.16 is vulnerable to a Cross-Site Scripting (XSS) attack, which can allow attackers to inject malicious scripts into web pages viewed by other users. This vulnerability is exploited via the userfiles/modules/tags/add_tagging_tagged.php file, potentially compromising user sessions and sensitive data. It is crucial for users of this version to apply the necessary patches to mitigate risks associated with this security flaw.

References

https://github.com/microweber/microweber/issues/1111

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.