GHSA-hrf4-hcpc-3345

ghsaUSosv

Denial of service in microweber

view advisory published 2022-03-16Licence: CC-BY-4.0

Microweber is drag and drop website builder and CMS with E-commerce. The microweber prior 1.2.12 application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. The post title input can be limited to 500 characters or max 1000 characters as a workaround.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-0961US	medium5.5	1.01% (63rd)	—	2022-03-15
The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request…

references

External citations — patches, advisories, analysis.

https://github.com/microweber/microweberPACKAGE
https://github.com/microweber/microweber/commit/f7acbd075dff4825b35b597b74958de9edce67fcWEB
https://huntr.dev/bounties/cdf00e14-38a7-4b6b-9bb4-3a71bf24e436WEB
https://nvd.nist.gov/vuln/detail/CVE-2022-0961ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan