9.8

CVE-2022-0895

Exploit

Static Code Injection in microweber/microweber

Static Code Injection in GitHub repository microweber/microweber prior to 1.3.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microweber ≫ Microweber Version < 1.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.69% 0.74
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
security@huntr.dev 7.7 1.8 5.3
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H
CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.

https://github.com/microweber/microweber/commit/b2baab6e582b2efe63788d367a2bb61a2fa26470
Patch
Third Party Advisory
https://huntr.dev/bounties/3c070828-fd00-476c-be33-9c877172363d
Patch
Third Party Advisory
Exploit