GHSA-582p-2fpg-x226

ghsaUSosv

Microweber vulnerable to command injection

view advisory published 2023-04-05Licence: CC-BY-4.0

microweber/microweber prior to 1.3.3 is vulnerable to command injection in the "first name" field. This allows for server-side template injection, which can lead to arbitrary code execution.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-1877US	critical9.8	1.80% (78th)	—	2023-04-05
Command Injection in GitHub repository microweber/microweber prior to 1.3.3.

references

External citations — patches, advisories, analysis.

https://github.com/microweber/microweberPACKAGE
https://github.com/microweber/microweber/commit/93a906d0bf096c3ab1674012a90c88d101e76c8dWEB
https://huntr.dev/bounties/71fe4b3b-20ac-448c-8191-7b99d7ffaf55WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-1877ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan