CVE-2024-33299 Microweber Cross-site Scripting vulnerability

What is CVE-2024-33299?

CVE-2024-33299 is a medium-severity cross-site scripting vulnerability in Microweber Microweber, published on 10 Jan 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name parameters in the endpoint /admin/module/view?type=users

Weakness: CWE-79

Which versions are affected by CVE-2024-33299?

2 open source packages ship an affected version, including microweber/microweber. It affects 1 product.

Products include Microweber Microweber.

How do I fix CVE-2024-33299?

No fix has been published for CVE-2024-33299 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2024-33299 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-33299 exists.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Microweber Microweber

• CVE-2022-0558 Cross-site Scripting (XSS) - Stored in microweber/microweber Critical 9.8
• CVE-2020-23138 File upload in n/a Critical 9.8
• CVE-2022-0688 Business Logic Errors in microweber/microweber Critical 9.4
• CVE-2022-0660 Generation of Error Message Containing Sensitive Information in microweber/microweber Critical 9.4
• CVE-2022-0913 Integer Overflow or Wraparound in microweber/microweber Critical 9.1

All Microweber Microweber vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-97h9-p9f8-4p3r.