vulnwire
5.3med

CVE-2023-2014

Cross-site Scripting (XSS) - Generic in microweber/microweber

Also known as GHSA-f4g6-c47x-qhww

Published 3 y ago · modified 4 mo ago · JSON

CVSS
5.3
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 42%
Public exploits
0
none known

Cross-site Scripting (XSS) - Generic in GitHub repository microweber/microweber prior to 1.3.3.

CISA SSVC assessment

Exploitation
Proof of concept public
Automatable
no
Technical impact
partial
Assessed
21 mo ago

Exploit prediction (EPSS)

0.48% probability of exploitation in the next 30 days, higher than 42% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.05.3CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L
NVD3.14.8CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CNA3.05.3CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L
GitHub3.14.8CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected packages

EcosystemPackageAffectedFixed in
packagistmicroweber/microweber
<1.3.3
1.3.3

Affected products

  • microweber microweber/microweber

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

  • huntr.dev /bounties/a77bf7ed-6b61-452e-b5ee-e20017e28d1a · x_transferred
  • github.com /microweber/microweber/commit/1a9b904722b35b00653c6ae72dca2969149159b3 · x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2023-2014 · advisory
  • github.com /microweber/microweber · package

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.