// For flags

CVE-2022-1631

Users Account Pre-Takeover or Users Account Takeover. in microweber/microweber

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

3
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Users Account Pre-Takeover or Users Account Takeover. in GitHub repository microweber/microweber prior to 1.2.15. Victim Account Take Over. Since, there is no email confirmation, an attacker can easily create an account in the application using the Victim’s Email. This allows an attacker to gain pre-authentication to the victim’s account. Further, due to the lack of proper validation of email coming from Social Login and failing to check if an account already exists, the victim will not identify if an account is already existing. Hence, the attacker’s persistence will remain. An attacker would be able to see all the activities performed by the victim user impacting the confidentiality and attempt to modify/corrupt the data impacting the integrity and availability factor. This attack becomes more interesting when an attacker can register an account from an employee’s email address. Assuming the organization uses G-Suite, it is much more impactful to hijack into an employee’s account.

Users Account Pre-Takeover o Users Account Takeover, en el repositorio de GitHub microweber/microweber versiones anteriores a 1.2.15. Toma el Control de la Cuenta de la Víctima. Dado que no se presenta confirmación por correo electrónico, un atacante puede crear fácilmente una cuenta en la aplicación usando el correo electrónico de la víctima. Esto permite a un atacante conseguir la preautenticación de la cuenta de la víctima. Además, debido a una falta de comprobación apropiada del correo electrónico proveniente de Social Login y al no comprobar si una cuenta ya existe, la víctima no identificará si una cuenta ya existe. Por lo tanto, la persistencia del atacante será mantenida. Un atacante sería capaz de visualizar todas las actividades llevadas a cabo por el usuario víctima impactando en la confidencialidad e intentando modificar/corromper los datos impactando en el factor de integridad y disponibilidad. Este ataque es más interesante cuando un atacante puede registrar una cuenta desde la dirección de correo electrónico de un empleado. Asumiendo que la organización usa G-Suite, es mucho más impactante secuestrar en la cuenta de un empleado

Microweber CMS versions 1.2.15 and below suffer from an account takeover vulnerability.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
Low
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-05-09 CVE Reserved
  • 2022-05-09 CVE Published
  • 2022-06-03 First Exploit
  • 2024-08-03 CVE Updated
  • 2024-11-17 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-284: Improper Access Control
  • CWE-863: Incorrect Authorization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Microweber
Search vendor "Microweber"
 Microweber
Search vendor "Microweber" for product "Microweber"
 < 1.2.15
Search vendor "Microweber" for product "Microweber" and version " < 1.2.15"
-
Affected