CVE-2022-2130

Deeper analysis

CVE-2022-2130 is a reflected cross-site scripting vulnerability (CWE-79) affecting the Microweber content management system in GitHub repository microweber/microweber prior to version 1.2.17. The flaw carries a CVSS 3.1 base score of 6.1 with network attack vector, low attack complexity, no required privileges, and required user interaction, resulting in changed scope with low integrity and availability impact but no confidentiality impact.

An unauthenticated remote attacker can exploit the issue by crafting a malicious URL containing a reflected script payload. When a victim user follows the link, the script executes in the victim's browser under the application's origin, enabling actions such as unauthorized modification of page content or limited disruption of application functionality.

Public references point to a specific commit (dbd37dda91911360db23269897c737e0abae2c24) that resolves the vulnerability and to a corresponding huntr.dev bounty report. The recommended mitigation is to upgrade Microweber to version 1.2.17 or later. The associated EPSS score has remained near its observed peak of 0.4661 with a current value of 0.4367 and does not indicate a material post-disclosure rise.