CVE-2022-3245
published 2022-09-20CVE-2022-3245: HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects…
PriorityP423medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.55%
41.8th percentile
HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microweber | microweber | < 1.3.2 | 1.3.2 |
| microweber | microweber | >= 0 < 1.3.2 | 1.3.2 |
| microweber | microweber_microweber | >= unspecified < 1.3.2 | 1.3.2 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv3.04.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Microweber vulnerable to HTML Injection in create tag functionality
ghsa·2022-09-21
CVE-2022-3245 [MEDIUM] CWE-79 Microweber vulnerable to HTML Injection in create tag functionality
Microweber vulnerable to HTML Injection in create tag functionality
HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input. A patch is available on commit f20abf30a1d9c1426c5fb757ac63998dc5b92bfc and is anticipated to be part of version 1.3.2.
OSV
Microweber vulnerable to HTML Injection in create tag functionality
osv·2022-09-21
CVE-2022-3245 [MEDIUM] Microweber vulnerable to HTML Injection in create tag functionality
Microweber vulnerable to HTML Injection in create tag functionality
HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input. A patch is available on commit f20abf30a1d9c1426c5fb757ac63998dc5b92bfc and is anticipated to be part of version 1.3.2.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/microweber/microweber/commit/f20abf30a1d9c1426c5fb757ac63998dc5b92bfchttps://huntr.dev/bounties/747c2924-95ca-4311-9e69-58ee0fb440a0https://github.com/microweber/microweber/commit/f20abf30a1d9c1426c5fb757ac63998dc5b92bfchttps://huntr.dev/bounties/747c2924-95ca-4311-9e69-58ee0fb440a0
2022-09-20
Published