CVE-2023-5244
published 2023-09-28CVE-2023-5244: Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 2.0.
PriorityP336medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
1.06%
60.3th percentile
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 2.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microweber | microweber | < 2.0 | 2.0 |
| microweber | microweber | 0 – 1.3.4 | — |
| microweber | microweber_microweber | >= unspecified < 2.0 | 2.0 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv3.05.0MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
vendor_redhat5.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Microweber Cross-site Scripting vulnerability
osv·2023-09-28
CVE-2023-5244 [MEDIUM] Microweber Cross-site Scripting vulnerability
Microweber Cross-site Scripting vulnerability
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber 1.3.4 and prior. A patch is available and anticipated to be part of the 2.x branch.
GHSA
Microweber Cross-site Scripting vulnerability
ghsa·2023-09-28
CVE-2023-5244 [MEDIUM] CWE-79 Microweber Cross-site Scripting vulnerability
Microweber Cross-site Scripting vulnerability
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber 1.3.4 and prior. A patch is available and anticipated to be part of the 2.x branch.
No detection rules found.
Nuclei
Microweber < V.2.0 - Cross-Site Scripting
nuclei·CVSS 6.1
CVE-2023-5244 [MEDIUM] Microweber < V.2.0 - Cross-Site Scripting
Microweber < V.2.0 - Cross-Site Scripting
Reflected Cross-Site Scripting Vulnerability in types GET parameter on the /editor_tools/rte_image_editor endpoint.
Template:
id: CVE-2023-5244
info:
name: Microweber < V.2.0 - Cross-Site Scripting
author: r3Y3r53
severity: medium
description: |
Reflected Cross-Site Scripting Vulnerability in types GET parameter on the /editor_tools/rte_image_editor endpoint.
impact: |
Unauthenticated attackers can inject malicious JavaScript via reflected XSS in the types parameter, potentially stealing user session cookies or performing actions on behalf of users.
remediation: |
Update Microweber to version 2.0 or later.
reference:
- https://huntr.dev/bounties/a3bd58ba-ca59-4cba-85d1-799f73a76470/
- https://vuldb.com/?id.240778
- https://nvd.nist.gov/vuln/det
No writeups or analysis indexed.
https://github.com/microweber/microweber/commit/1cb846f8f54ff6f5c668f3ae64dd81740a7e8968https://huntr.dev/bounties/a3bd58ba-ca59-4cba-85d1-799f73a76470https://github.com/microweber/microweber/commit/1cb846f8f54ff6f5c668f3ae64dd81740a7e8968https://huntr.dev/bounties/a3bd58ba-ca59-4cba-85d1-799f73a76470
2023-09-28
Published