CVE-2022-0968 Integer Overflow in microweber

What is CVE-2022-0968?

CVE-2022-0968 is a high-severity denial of service vulnerability in Microweber Microweber, published on 15 Mar 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in GitHub repository microweber/microweber prior to 1.2.12.

Weakness: CWE-190

Which versions are affected by CVE-2022-0968?

2 open source packages ship an affected version, including microweber/microweber. It affects 1 product.

Products include Microweber Microweber.

How do I fix CVE-2022-0968?

No fix has been published for CVE-2022-0968 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-0968 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-0968 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in Microweber Microweber

• CVE-2022-0558 Cross-site Scripting (XSS) - Stored in microweber/microweber Critical 9.8
• CVE-2020-23138 File upload in n/a Critical 9.8
• CVE-2022-0688 Business Logic Errors in microweber/microweber Critical 9.4
• CVE-2022-0660 Generation of Error Message Containing Sensitive Information in microweber/microweber Critical 9.4
• CVE-2022-0913 Integer Overflow or Wraparound in microweber/microweber Critical 9.1

All Microweber Microweber vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5fxv-xx5p-g2fv.