GHSA-j8cx-j9j2-f29w

ghsaUSosv

Insecure Storage of Sensitive Information in Microweber

view advisory published 2022-02-24Licence: CC-BY-4.0

Microweber prior to version 1.3 does not strip images of EXIF data, exposing information about users' locations, device hardware, and device software.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-0724US	medium6.5	1.35% (71st)	—	2022-02-23
Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3.

references

External citations — patches, advisories, analysis.

https://github.com/microweber/microweberPACKAGE
https://github.com/microweber/microweber/commit/b592c86d2b927c0cae5b73b87fb541f25e777aa3WEB
https://huntr.dev/bounties/0cdc4a29-dada-4264-b326-8b65b4f11062WEB
https://nvd.nist.gov/vuln/detail/CVE-2022-0724ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan