GHSA-gm8c-w9cm-c445

Microweber vulnerable to HTML Injection in create tag functionality

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-3245

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	microweber/microweber	< 1.3.2	1.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input. A patch is available on commit f20abf30a1d9c1426c5fb757ac63998dc5b92bfc and is anticipated to be part of version 1.3.2.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-3245 advisory
https://github.com/microweber/microweber/commit/f20abf30a1d9c1426c5fb757ac63998dc5b92bfc web
https://github.com/microweber/microweber package
https://huntr.dev/bounties/747c2924-95ca-4311-9e69-58ee0fb440a0 web