Vulnerability Details : CVE-2022-3245
HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2022-3245
- cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-3245
0.09%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 35 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-3245
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L |
0.9
|
3.4
|
huntr.dev | |
|
6.1
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
2.8
|
2.7
|
NIST |
CWE ids for CVE-2022-3245
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
-
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.Assigned by: security@huntr.dev (Secondary)
References for CVE-2022-3245
-
https://huntr.dev/bounties/747c2924-95ca-4311-9e69-58ee0fb440a0
HTML Injection vulnerability in create tag functionality vulnerability found in microweberExploit;Issue Tracking;Patch;Third Party Advisory
-
https://github.com/microweber/microweber/commit/f20abf30a1d9c1426c5fb757ac63998dc5b92bfc
update · microweber/microweber@f20abf3 · GitHubPatch;Third Party Advisory
Jump to