Medium severity · published Sep 20, 2022
CVE-2022-3245
Code Injection in display of tag title on saving tags in microweber/microweber
6.1
CVSS
0.7%
EPSS
No
On KEV
Description
HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
microweber/microweber · microweber
before 1.3.2 · source: vendor
MI
Microweber · Microweber
before 1.3.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-3245
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-3245
Patch
https://github.com/microweber/microweber/commit/f20abf30a1d9c1426c5fb757ac63998dc5b92bfc
Exploit
https://huntr.dev/bounties/747c2924-95ca-4311-9e69-58ee0fb440a0
More from microweber/microweber
9.8
CVE-2023-1877
Command Injection in microweber/microweber
9.8
CVE-2022-2368
Authentication Bypass by Spoofing in microweber/microweber
9.8
CVE-2022-0895
Static Code Injection in microweber/microweber
8.8
CVE-2023-2240
Improper Privilege Management in microweber/microweber
8.8
CVE-2022-1631
Users Account Pre-Takeover or Users Account Takeover. in microweber/microweber