Miggo Logo
Book a Demo
Miggo Vulnerability Database
→
CVE-2022-1555

CVE-2022-1555:
Microweber vulnerable to cross-site scripting (XSS)

6.1

CVSS Score

Basic Information

CVE ID
CVE-2022-1555
GHSA ID
GHSA-6346-5r4h-ff5x
EPSS Score
-
CWE
CWE-79
Published
5/5/2022
Updated
2/1/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
microweber/microwebercomposer<= 1.2.15

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The commit diff shows the vulnerability was patched by adding xss_clean() to sanitize $productKeyword. The original code lacked output encoding when injecting this variable into the HTML placeholder attribute, making it susceptible to XSS. The direct echo statement in the Blade template without sanitization functions is the vulnerable point.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Mi*row***r is * *r** *n* *rop w**sit* *uil**r *n* * pow*r*ul n*xt **n*r*tion *MS. Mi*row***r v*rsions *.*.** *n* prior *r* vuln*r**l* to *ross-sit* s*riptin*. T*is *oul* l*** to inj**tion o* *r*itr*ry J*v*S*ript *o**, ******m*nt o* * p***, or st**lin

Reasoning

T** *ommit *i** s*ows t** vuln*r**ility w*s p*t**** *y ***in* xss_*l**n() to s*nitiz* $pro*u*tK*ywor*. T** ori*in*l *o** l**k** output *n*o*in* w**n inj**tin* t*is v*ri**l* into t** *TML pl****ol**r *ttri*ut*, m*kin* it sus**pti*l* to XSS. T** *ir**t