GHSA-9r6p-hg4g-5gxp CVE-2023-6599
Microweber missing standardized error handling mechanism
- Severity
- 3.1 / 10
- Medium · CVSS 3.0
- Exploit chance (EPSS)
- 0.49%
- Chance of exploitation in the next 30 days. Higher than 42.17% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-544 Missing Standardized Error Handling Mechanism
- CWE-755 Improper Handling of Exceptional Conditions
- Fix
2.0.0- Upgrade microweber/microweber to this version or later
Description
Missing Standardized Error Handling Mechanism in GitHub repository microweber/microweber prior to 2.0.0.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| microweber/microweber | < 2.0.0 |
2.0.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
microweber/microweber Packagist → 2.0.0
- composer
composer require microweber/microweber:^2.0.0
Severity breakdown
CVSS 3.0 3.1
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Weakness
CWE-544: Missing Standardized Error Handling Mechanism
The product does not use a standardized method for handling errors throughout the code, which might introduce inconsistent error handling and resultant weaknesses.
How to prevent it
- Architecture and Design: define a strategy for handling errors of different severities, such as fatal errors versus basic log events. Use or create built-in language features, or an external package, that provides an easy-to-use API and define coding standards for the detection and handling of errors.
CWE-755: Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-vv4x-qcpq-wgrg Microweber vulnerable to Path Traversal | High | Also affects microweber/microweber |
| GHSA-6w5w-jx4x-vjvw Microweber Cross-site Scripting vulnerability | Medium | Also affects microweber/microweber |
| GHSA-5jg5-xqfw-rv92 Microweber has a Cross-site Scripting vulnerability | Medium | Also affects microweber/microweber |
| GHSA-2x2j-3c2v-g3c2 Microweber XSS Vulnerability in the homepage Endpoint | High | Also affects microweber/microweber |
| GHSA-mvj3-hc7j-vp74 Microweber has Reflected XSS Vulnerability in the layout Parameter | Medium | Also affects microweber/microweber |
| GHSA-8357-fjvx-xrm8 Microweber has Reflected XSS Vulnerability in the id Parameter | Medium | Also affects microweber/microweber |
| GHSA-782f-gxj5-xvqc Microweber Has Stored XSS Vulnerability in User Profile Fields | High | Also affects microweber/microweber |
| GHSA-j64v-xh5w-8hqj Microweber CMS API has authenticated local file inclusion vulnerability | High | Also affects microweber/microweber |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor