CVE-2022-0961 Denial of service in microweber

What is CVE-2022-0961?

CVE-2022-0961 is a high-severity denial of service vulnerability in Microweber Microweber, published on 15 Mar 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in GitHub repository microweber/microweber prior to 1.2.12.

Weakness: CWE-190

Which versions are affected by CVE-2022-0961?

2 open source packages ship an affected version, including microweber/microweber. It affects 1 product.

Products include Microweber Microweber.

How do I fix CVE-2022-0961?

No fix has been published for CVE-2022-0961 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-0961 being exploited?

There is no known exploitation of CVE-2022-0961 in the wild and no public exploit code.

Other vulnerabilities in Microweber Microweber

• CVE-2022-0558 Cross-site Scripting (XSS) - Stored in microweber/microweber Critical 9.8
• CVE-2020-23138 File upload in n/a Critical 9.8
• CVE-2022-0688 Business Logic Errors in microweber/microweber Critical 9.4
• CVE-2022-0660 Generation of Error Message Containing Sensitive Information in microweber/microweber Critical 9.4
• CVE-2022-0913 Integer Overflow or Wraparound in microweber/microweber Critical 9.1

All Microweber Microweber vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hrf4-hcpc-3345.