CVE-2022-0560: Open redirect in microweber
6.1
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.6075%
CWE
Published
2/12/2022
Updated
2/3/2023
KEV Status
No
Technology
PHP
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
microweber/microweber | composer | < 1.2.11 | 1.2.11 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The key evidence is the patch modification to Route::resource('page', 'PageController') where the 'show' method was explicitly excluded. In Laravel resource routing, the 'show' method typically handles displaying individual resources (GET /page/{id}). By removing this route, the developers likely eliminated an endpoint that improperly handled redirects using unvalidated user input. The absence of other security-related changes in the commit strengthens the correlation between the removed route and the open redirect vulnerability.