Microweber vulnerable to HTML Injection in create tag functionality
The advisory, in context
HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input. A patch is available on commit f20abf30a1d9c1426c5fb757ac63998dc5b92bfc and is anticipated to be part of version 1.3.2.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 1.3.2
Fixed in 1.3.2
32 explicitly affected versions
0.9.346, 0.93, 0.931, 0.934, 0.951, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.1, v1.2.10, v1.2.11, v1.2.12, v1.2.13, v1.2.14, v1.2.15, v1.2.16, v1.2.17, v1.2.18, v1.2.19, v1.2.20, v1.2.21, v1.2.3, v1.2.4, v1.2.5, v1.2.6, v1.2.7, v1.2.8, v1.2.9, v1.3.0, v1.3.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.9.346",
"0.93",
"0.931",
"0.934",
"0.951",
"1.0.3",
"1.0.4",
"1.0.5",
"1.0.6",
"1.0.7",
"1.1",
"v1.2.10",
"v1.2.11",
"v1.2.12",
"v1.2.13",
"v1.2.14",
"v1.2.15",
"v1.2.16",
"v1.2.17",
"v1.2.18",
"v1.2.19",
"v1.2.20",
"v1.2.21",
"v1.2.3",
"v1.2.4",
"v1.2.5",
"v1.2.6",
"v1.2.7",
"v1.2.8",
"v1.2.9",
"v1.3.0",
"v1.3.1"
]
}