CVE-2022-0597
published 2022-02-15CVE-2022-0597: Open Redirect in Packagist microweber/microweber prior to 1.2.11.
PriorityP335medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
3.02%
85.8th percentile
Open Redirect in Packagist microweber/microweber prior to 1.2.11.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microweber | microweber | < 1.2.11 | 1.2.11 |
| microweber | microweber | >= 0 < 1.2.11 | 1.2.11 |
| microweber | microweber_microweber | >= unspecified < 1.2.11 | 1.2.11 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv3.04.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Open redirect in microweber
osv·2022-02-16
CVE-2022-0597 [MEDIUM] Open redirect in microweber
Open redirect in microweber
Open Redirect in Packagist microweber/microweber prior to 1.2.11.
GHSA
Open redirect in microweber
ghsa·2022-02-16
CVE-2022-0597 [MEDIUM] CWE-601 Open redirect in microweber
Open redirect in microweber
Open Redirect in Packagist microweber/microweber prior to 1.2.11.
No detection rules found.
Nuclei
Microweber < 1.2.11 - Open Redirection
nuclei·CVSS 6.1
CVE-2022-0597 [MEDIUM] Microweber < 1.2.11 - Open Redirection
Microweber < 1.2.11 - Open Redirection
Open Redirect in Packagist microweber/microweber prior to 1.2.11.
Template:
id: CVE-2022-0597
info:
name: Microweber < 1.2.11 - Open Redirection
author: Farish
severity: medium
description: |
Open Redirect in Packagist microweber/microweber prior to 1.2.11.
impact: |
Attackers can redirect users to malicious websites through the redirect_to parameter, potentially facilitating phishing attacks or malware distribution.
remediation: |
Upgrade to Microweber version 1.2.11 or later.
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2022-0597
- https://huntr.dev/bounties/68c22eab-cc69-4e9f-bcb6-2df3db626813/
- https://www.mend.io/vulnerability-database/CVE-2022-0597
- https://github.com/microweber/microweber/commit/acfc6a581d1ea86096d1b0ecd8a0eec927c0e9
https://github.com/microweber/microweber/commit/acfc6a581d1ea86096d1b0ecd8a0eec927c0e9b2https://huntr.dev/bounties/68c22eab-cc69-4e9f-bcb6-2df3db626813https://github.com/microweber/microweber/commit/acfc6a581d1ea86096d1b0ecd8a0eec927c0e9b2https://huntr.dev/bounties/68c22eab-cc69-4e9f-bcb6-2df3db626813
2022-02-15
Published