CVE-2023-47379: XSS
First published: Wed Nov 08 2023(Updated: )
Microweber CMS prior to version 2.0.3 is vulnerable to stored Cross Site Scripting (XSS) via the profile picture file upload functionality.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/microweber/microweber | <2.0.3 | 2.0.3 |
| Microweber Microweber | =2.0.1 | |
| =2.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/microweber/microweber/blob/master/CHANGELOG.md
- https://github.com/microweber/microweber/commit/c6e7ea9d0abd7564a3bb23c14ad172e4ccf27a7e#diff-fac4e7e9eca69c10d074bf8c5eac7f64b018c6b4d91dcad54b340a8560049e00
- https://www.getastra.com/blog/security-audit/stored-xss-vulnerability/
- https://nvd.nist.gov/vuln/detail/CVE-2023-47379
- https://github.com/microweber/microweber/commit/a481f079d74e82f6094abf15d67e814349d1038a
- https://github.com/advisories/GHSA-jmwm-w2rm-prv9 (Advisory)
Frequently Asked Questions
What is CVE-2023-47379?
CVE-2023-47379 is a vulnerability in Microweber CMS that allows for stored Cross Site Scripting (XSS) attacks via the profile picture file upload functionality.
How does CVE-2023-47379 affect Microweber CMS?
CVE-2023-47379 affects Microweber CMS versions prior to 2.0.3.
What is the impact of CVE-2023-47379?
The impact of CVE-2023-47379 is that it allows an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to account hijacking, data theft, or other malicious activities.
How can I fix CVE-2023-47379 in Microweber CMS?
To fix CVE-2023-47379, upgrade Microweber CMS to version 2.0.3 or higher.
Where can I find more information about CVE-2023-47379?
You can find more information about CVE-2023-47379 in the references provided: [link1](https://www.getastra.com/blog/security-audit/stored-xss-vulnerability/), [link2](https://github.com/microweber/microweber/commit/c6e7ea9d0abd7564a3bb23c14ad172e4ccf27a7e#diff-fac4e7e9eca69c10d074bf8c5eac7f64b018c6b4d91dcad54b340a8560049e00), [link3](https://github.com/microweber/microweber/blob/master/CHANGELOG.md)
- collector/github-advisory-latest
- alias/GHSA-jmwm-w2rm-prv9
- alias/CVE-2023-47379
- collector/nvd-cve
- collector/github-advisory
- agent/author
- agent/type
- agent/first-publish-date
- agent/remedy
- agent/severity
- agent/weakness
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/event
- package-manager/composer
- vendor/microweber
- canonical/microweber microweber
- version/microweber microweber/2.0.1