CVE-2022-33012

Severity Score

8.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack.

Se descubrió que Microweber v1.2.15 permitía a los atacantes realizar una apropiación de cuentas mediante un ataque de inyección de encabezado del host.

*Credits: N/A

CVSS Scores

NISTv3.1 8.8

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-06-13 CVE Reserved
2022-11-22 CVE Published
2024-07-13 EPSS Updated
2024-08-03 CVE Updated
2024-08-03 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CAPEC

References (4)

URL	Tag	Source
https://github.com/microweber/microweber	Product
https://www.pethuraj.com/blog/how-i-earned-800-for-host-header-injection-vulnerability	Third Party Advisory

URL	Date	SRC
https://blog.jitendrapatro.me/cve-2022-33012-account-takeover-through-password-reset-poisoning	2024-08-03
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Account%20Takeover#account-takeover-through-password-reset-poisoning	2024-08-03

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Microweber Search vendor "Microweber"		Microweber Search vendor "Microweber" for product "Microweber"				1.2.15 Search vendor "Microweber" for product "Microweber" and version "1.2.15"		-		Affected