CVE-2024-33299: Microweber Cross-site Scripting Vulnerability
Summary
CVE-2024-33299: Microweber Cross-site Scripting vulnerability. Affects microweber/microweber versions < 2.0.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Microweber is an open-source content management system (CMS) designed for building websites and online stores. It offers a user-friendly interface, drag-and-drop functionality, and a variety of modules for customization. However, like many web applications, it is susceptible to security vulnerabilities, including Cross-site Scripting (XSS), which can compromise user data and application integrity.
Vulnerability Detail
The vulnerability identified as CVE-2024-33299 is a Cross-site Scripting (XSS) flaw present in Microweber version 2.0.9. This vulnerability allows remote attackers to inject arbitrary scripts into the application via the 'First Name' and 'Last Name' parameters in the endpoint /admin/module/view?type=users. If exploited, attackers can execute malicious scripts in the context of the user's browser, potentially leading to data theft, session hijacking, or further attacks on the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can sanitize user inputs for the 'First Name' and 'Last Name' fields to prevent script injection. Implement input validation and encoding to ensure that any user-provided data is treated as plain text rather than executable code.
Conclusion
The CVE-2024-33299 vulnerability in Microweber poses a significant risk due to its potential for Cross-site Scripting attacks. Users are strongly advised to update their installations to the latest version to safeguard against exploitation. Additionally, implementing input validation can provide a temporary solution until an update can be performed.
See every vulnerability recorded for microweber/microweber →
FAQ
Cross-site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. It can lead to unauthorized actions and data theft.
If you are using Microweber version 2.0.9 or earlier, your installation is vulnerable. You can check your version in the admin panel or by reviewing your composer.lock file.
Exploitation of this vulnerability can lead to unauthorized access to user accounts, data theft, and the execution of malicious actions on behalf of the user.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the composer.lock file. You can check your application for vulnerabilities using the Vulert playground at Vulert Scanner without needing to sign up.
If an immediate update is not possible, implement input validation and sanitization as a temporary measure to mitigate the risk of XSS attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for microweber/microweber.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
