Cross-site scripting in Microweber - CVE-2018-19917
Published: March 21, 2019 / Updated: August 8, 2020
Vulnerability identifier: #VU36059
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-19917
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Microweber CMS Ltd.
Affected software:
Microweber
Microweber
Detailed vulnerability description
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Microweber 1.0.8 has reflected cross-site scripting (XSS) vulnerabilities.
How to mitigate CVE-2018-19917
Install update from vendor's website.
Sources
- http://packetstormsecurity.com/files/151005/Microweber-1.0.8-Cross-Site-Scripting.html
- http://seclists.org/fulldisclosure/2019/Jan/12
- http://seclists.org/fulldisclosure/2019/Jan/25
- https://github.com/microweber/microweber/commits/master
- https://www.netsparker.com/web-applications-advisories/ns-18-038-reflected-cross-site-scripting-in-microweber/