Read the docs
TI-2022-01501 Aliases CVE-2022-1631GHSA-73rp-q4rx-5grc

Users Account Pre-Takeover or Users Account Takeover. in microweber/microweber

Priority MEDIUM 49CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

Users Account Pre-Takeover or Users Account Takeover. in GitHub repository microweber/microweber prior to 1.2.15. Victim Account Take Over. Since, there is no email confirmation, an attacker can easily create an account in the application using the Victim’s Email. This allows an attacker to gain pre-authentication to the victim’s account. Further, due to the lack of proper validation of email coming from Social Login and failing to check if an account already exists, the victim will not identify if an account is already existing. Hence, the attacker’s persistence will remain. An attacker would be able to see all the activities performed by the victim user impacting the confidentiality and attempt to modify/corrupt the data impacting the integrity and availability factor. This attack becomes more interesting when an attacker can register an account from an employee’s email address. Assuming the organization uses G-Suite, it is much more impactful to hijack into an employee’s account.

Why it matters now

EPSS 0.0885 95th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed microweber/microweber (microweber): 1.2.15microweber/microweber (Packagist): 1.2.15

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
microwebermicroweber/microweberbefore 1.2.151.2.15Patch availableCNA
—microweber/microweber (Packagist)before 1.2.151.2.15Patch availableGHSA-73rp-q4rx-5grc
  • microweber/microweber Vendormicroweber Affected before 1.2.15 Fixed in 1.2.15 Patch available CNA
  • microweber/microweber (Packagist) Vendor— Affected before 1.2.15 Fixed in 1.2.15 Patch available GHSA-73rp-q4rx-5grc

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*before 1.2.15Vulnerablemicroweber
  • cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:* Versions before 1.2.15 Vulnerable ·microweber

Remediation

  • Fix · CNA microweber/microweber (microweber) Fixed in 1.2.15
  • Fix · GHSA-73rp-q4rx-5grc microweber/microweber (Packagist) Fixed in 1.2.15 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-1631
  2. 2026-10-03 Alias added: GHSA-73rp-q4rx-5grc

References

Exploit 2

Patch 1

Advisory 1

Other 1

  • TI-2023-01763 Command Injection in microweber/microweber CVSS 3.1CRITICAL 9.8
  • TI-2023-02100 Improper Privilege Management in microweber/microweber CVSS 3.1HIGH 8.8
  • TI-2022-14518 Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack. CVSS 3.1HIGH 8.8
  • TI-2023-04891 Use of Hard-coded Credentials in microweber/microweber CVSS 3.1HIGH 7.5
  • TI-2025-37870 Microweber CMS 2.0 has Weak Password Requirements. CVSS 3.1HIGH 8.3
  • TI-2022-04247 Cross-site Scripting (XSS) - Stored in microweber/microweber CVSS 3.1MEDIUM 6.1
See all 113 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences