{"id":"CVE-2022-1584","published":"2022-05-04T17:00:13Z","modified":"2024-08-03T00:10:03Z","title":"Reflected XSS in microweber/microweber","vendor":"microweber","product":"microweber/microweber","tier":"tail","description":{"text":"Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16. Executing JavaScript as the victim","provenance":"source","from":"CVE.org"},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00853,"percentile":0.58235,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://huntr.dev/bounties/69f4ca67-d615-4f25-b2d1-19df7bf1107d","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/microweber/microweber/commit/527abd148e6b7aff8df92a9f1aa951e5bebac59c","tags":["x_refsource_MISC"]}],"priority":{"score":16.1,"factors":[{"name":"EPSS percentile","points":11.65},{"name":"CVSS severity","points":4.41}]},"vendorSlug":"microweber","affectedVersions":[{"vendor":"microweber","product":"microweber/microweber","versions":[">= unspecified, < 1.2.16"]}],"affected":[{"ecosystem":"Packagist","package":"microweber/microweber","vulnerableRanges":["<1.2.16"],"patched":["1.2.16"],"from":["GHSA-f23x-4gf4-m9ff"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-3666","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-microweber-microweber-cve-2022-1584","children":[{"from":"CVE-2022-1584","to":"CVE-2022-2470","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/MicroweberPackages/App/Http/Controllers/ApiController.php"],"commits":["https://github.com/microweber/microweber/commit/527abd148e6b7aff8df92a9f1aa951e5bebac59c","https://github.com/microweber/microweber/commit/d28655183800b833abb20ccd55e1628f16ff65e4"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.49,"basis":"same product + CWE + description similarity"}]},{"from":"CVE-2022-1584","to":"CVE-2024-40101","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/MicroweberPackages/Helper/XSSClean.php"],"commits":["https://github.com/microweber/microweber/commit/527abd148e6b7aff8df92a9f1aa951e5bebac59c","https://github.com/microweber/microweber/commit/0dede6886c6df3d1f31c4f4e3ba1ab4a336fbf79"],"basis":"shared function","functions":["clean"]}]}],"packageHistory":[{"cve":"CVE-2022-1439","published":"2022-04-22","fixed":"1.2.15","kev":false},{"cve":"CVE-2022-1504","published":"2022-04-27","fixed":"1.2.15","kev":false},{"cve":"CVE-2022-1631","published":"2022-05-09","fixed":"1.2.15","kev":false,"link":{"from":"CVE-2022-1631","to":"CVE-2022-1584","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:microweber/microweber","fromFixed":"1.2.15","toFixed":"1.2.16","daysApart":-5}]}},{"cve":"CVE-2022-1584","published":"2022-05-04","fixed":"1.2.16","kev":false},{"cve":"CVE-2022-2174","published":"2022-06-22","fixed":"1.2.18","kev":false,"link":{"from":"CVE-2022-1584","to":"CVE-2022-2174","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:microweber/microweber","fromFixed":"1.2.16","toFixed":"1.2.18","daysApart":49},{"kind":"similar","provenance":"machine","score":0.49,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2022-2252","published":"2022-06-29","fixed":"1.2.19","kev":false},{"cve":"CVE-2022-2280","published":"2022-07-01","fixed":"1.2.19","kev":false}],"package":"Packagist:microweber/microweber"}}