GHSA-3mmh-vq9w-4c3g

Microweber vulnerable to Reflected Cross-site Scripting

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-4617

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	microweber/microweber	<= 1.3.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Microweber versions 1.3.1 and prior are vulnerable to Reflected Cross-site Scripting (XSS). A patch is available on the 1.4, dev, and laravel-sail branches.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-4617 advisory
https://github.com/microweber/microweber/commit/df8add930ecfa7f5b18c67c3f748c137fe890906 web
https://github.com/microweber/microweber package
https://huntr.dev/bounties/1fb2ce08-7016-45fa-b402-ec08d700e4df web