CVE-2022-1036: Integer Overflow or Wraparound (CWE-190)
value: Able to create an account with long password leads to memory corruption / Integer Overflow in GitHub repository microweber/microweber prior to 1.2.12.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.5
Published: 2022-03-22T13:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/User/Http/Controllers/UserForgotPasswordController.php, src/MicroweberPackages/User/Http/Requests/RegisterRequest.php, src/MicroweberPackages/User/Http/Requests/UserCreateRequest.php, src/MicroweberPackages/User/Http/Requests/UserUpdateRequest.php
Commit date: 2022-03-21 14:43:49 +0200
Commit message: max 500 chars on password

Diff: diff --git a/src/MicroweberPackages/User/Http/Controllers/UserForgotPasswordController.php b/src/MicroweberPackages/User/Http/Controllers/UserForgotPasswordController.php
index 92e815bf1cae..8d130edb995a 100644
--- a/src/MicroweberPackages/User/Http/Controllers/UserForgotPasswordController.php
+++ b/src/MicroweberPackages/User/Http/Controllers/UserForgotPasswordController.php
@@ -141,11 +141,11 @@ class UserForgotPasswordController extends Controller
     public function update(Request $request)
     {
         $request->validate([
             'token' => 'required',
             'email' => 'required|email',
-            'password' => 'required|min:1|confirmed',
+            'password' => 'required|min:1|confirmed|max:500',
         ]);
 
         $tokenMd5 = \MicroweberPackages\User\Models\PasswordReset::where('email', $request->get('email'))
             //->where(\DB::raw('md5(token)'), $request->get('token'))
             ->where('token', $request->get('token'))
diff --git a/src/MicroweberPackages/User/Http/Requests/RegisterRequest.php b/src/MicroweberPackages/User/Http/Requests/RegisterRequest.php
index 94c49ce3b1f7..5fdd8dcc5d67 100644
--- a/src/MicroweberPackages/User/Http/Requests/RegisterRequest.php
+++ b/src/MicroweberPackages/User/Http/Requests/RegisterRequest.php
@@ -81,11 +81,11 @@ class RegisterRequest extends FormRequest
             $rules['terms'] = 'terms:terms_user';
             if (isset($inputs['newsletter_subscribe']) and $inputs['newsletter_subscribe']) {
                 $rules['terms'] = $rules['terms'] . ', terms_newsletter';
             }
         }
-        $rules['password'] = 'required|min:1';
+        $rules['password'] = 'required|min:1|max:500';
 
 
         return $rules;
     }
 }
diff --git a/src/MicroweberPackages/User/Http/Requests/UserCreateRequest.php b/src/MicroweberPackages/User/Http/Requests/UserCreateRequest.php
index 529ab66c4c2f..d74a4dde1d2e 100644
--- a/src/MicroweberPackages/User/Http/Requests/UserCreateRequest.php
+++ b/src/MicroweberPackages/User/Http/Requests/UserCreateRequest.php
@@ -12,10 +12,11 @@ class UserCreateRequest extends FormRequest
      * @return array
      */
     public function rules()
     {
         $rules = [
+             'password'=>'max:500',
              'first_name'=>'max:500',
              'last_name'=>'max:500',
              'phone'=>'max:500',
              'username' => 'required|unique:users,username|max:500',
              'email' => 'unique:users,email|max:500',
diff --git a/src/MicroweberPackages/User/Http/Requests/UserUpdateRequest.php b/src/MicroweberPackages/User/Http/Requests/UserUpdateRequest.php
index d189305fee5d..c34b0148c261 100644
--- a/src/MicroweberPackages/User/Http/Requests/UserUpdateRequest.php
+++ b/src/MicroweberPackages/User/Http/Requests/UserUpdateRequest.php
@@ -17,10 +17,11 @@ class UserUpdateRequest extends FormRequest
     {
 
         $ignore = Rule::unique('users')->ignore($this->id ?? 0, 'id');
 
         return [
+            'password'=>'max:500',
             'first_name'=>'max:500',
             'last_name'=>'max:500',
             'phone'=>'max:500',
             'email' => [
                 $ignore,

Vulnerable code:             'password' => 'required|min:1|confirmed',
        $rules['password'] = 'required|min:1';
Fixed code:             'password' => 'required|min:1|confirmed|max:500',
        $rules['password'] = 'required|min:1|max:500';
             'password'=>'max:500',
            'password'=>'max:500',