179 lines
7.5 KiB
JSON
179 lines
7.5 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2026-5696",
|
||
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "INCIBE",
|
||
"dateReserved": "2026-04-06T12:34:00.885Z",
|
||
"datePublished": "2026-09-23T10:22:43.693Z",
|
||
"dateUpdated": "2026-09-23T13:09:33.735Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
|
||
"shortName": "INCIBE",
|
||
"dateUpdated": "2026-09-23T10:22:43.693Z"
|
||
},
|
||
"title": "Multiple vulnerabilities in the Microweber administration panel",
|
||
"datePublic": "2026-09-23T10:21:00.000Z",
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"cweId": "CWE-79",
|
||
"description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"vendor": "Microweber",
|
||
"product": "Administration panel",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "2.0.19"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"operator": "OR",
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:a:microweber:administration_panel:2.0.19:*:*:*:*:*:*:*"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the ‘group’ parameter of the ‘/admin/settings’ endpoint in the administration panel. A successful exploit allows an attacker to trick an authenticated user into executing malicious JavaScript code in their browser. This enables the attacker to perform actions without the victim’s consent, steal confidential information or hijack the user’s session.",
|
||
"supportingMedia": [
|
||
{
|
||
"type": "text/html",
|
||
"base64": false,
|
||
"value": "Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the ‘group’ parameter of the ‘/admin/settings’ endpoint in the administration panel. A successful exploit allows an attacker to trick an authenticated user into executing malicious JavaScript code in their browser. This enables the attacker to perform actions without the victim’s consent, steal confidential information or hijack the user’s session."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-microweber-administration-panel"
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"format": "CVSS",
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "GENERAL"
|
||
}
|
||
],
|
||
"cvssV4_0": {
|
||
"attackVector": "NETWORK",
|
||
"attackComplexity": "LOW",
|
||
"attackRequirements": "NONE",
|
||
"privilegesRequired": "HIGH",
|
||
"userInteraction": "ACTIVE",
|
||
"vulnConfidentialityImpact": "NONE",
|
||
"subConfidentialityImpact": "HIGH",
|
||
"vulnIntegrityImpact": "NONE",
|
||
"subIntegrityImpact": "NONE",
|
||
"vulnAvailabilityImpact": "NONE",
|
||
"subAvailabilityImpact": "NONE",
|
||
"exploitMaturity": "NOT_DEFINED",
|
||
"Safety": "NOT_DEFINED",
|
||
"Automatable": "NOT_DEFINED",
|
||
"Recovery": "NOT_DEFINED",
|
||
"valueDensity": "NOT_DEFINED",
|
||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||
"providerUrgency": "NOT_DEFINED",
|
||
"version": "4.0",
|
||
"baseSeverity": "MEDIUM",
|
||
"baseScore": 5.9,
|
||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N"
|
||
}
|
||
}
|
||
],
|
||
"solutions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "There is no reported solution at this time.",
|
||
"supportingMedia": [
|
||
{
|
||
"type": "text/html",
|
||
"base64": false,
|
||
"value": "There is no reported solution at this time."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"value": "David Aparicio Salcedo",
|
||
"type": "finder"
|
||
}
|
||
],
|
||
"source": {
|
||
"discovery": "EXTERNAL"
|
||
},
|
||
"x_generator": {
|
||
"engine": "Vulnogram 1.0.5"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2026-09-23T13:09:23.700269Z",
|
||
"id": "CVE-2026-5696",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-09-23T13:09:33.735Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |