Vulnerability · Published Mar 15, 2022 · Assigned by @huntrdev
CVE-2022-0968The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in microweber/microweber
High 7.2
In plain English
A high-severity integer overflow in microweber/microweber from microweber. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.7% (higher than 90% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.0)7.2High
Exploit odds (30 days)3.7%top 10.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in GitHub repository microweber/microweber prior to 1.2.12.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | microweber/microweber | no fix listed | GHSA-5fxv-xx5p-g2fv |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| microweber | microweber/microweber | unspecified – before 1.2.12 |
Weakness: CWE-190 · Vector: CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H