Static Code Injection in Microweber
Date: 2022-03
Affected: composer/microweber/microweber
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2022-0895
CWE: CWE-94
CWE-96
CVSS: 7.7 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H)

Microweber is a new generation CMS with drag and drop. Prior to version 1.3, Microweber is vulnerable to static code injection.


Mitigations:

Architectural layers (MAESTRO):