Denial of service in microweber
Date: 2022-03
Affected: composer/microweber/microweber
Attack vector: dos
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2022-0961
CWE: CWE-190
CVSS: 7.1 (CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)

Microweber is drag and drop website builder and CMS with E-commerce. The microweber prior 1.2.12 application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. The post title input can be limited to 500 characters or max 1000 characters as a workaround.


Mitigations:

Architectural layers (MAESTRO):