Security readout for executives and security teams
Plain-English summary
Microweber versions 2.0.15 and earlier have a reflected XSS issue in the public search page. An unauthenticated remote attacker can cause script or HTML to be reflected through the keywords parameter, creating risk to site visitors and administrative users who interact with affected pages.
Executive priority
Treat this as a high-priority web application remediation for Microweber sites. It is not marked as known exploited in the provided sources, but public unauthenticated reachability increases business risk.
Technical view
CVE-2024-40101 is CWE-79 reflected XSS in /search via the keywords parameter. The CVSS 3.1 score is 7.2 with network attack vector, low complexity, no privileges, changed scope, and low confidentiality and integrity impact. The bundle references a Microweber commit but does not identify a named fixed release.
Likely exposure
Exposure is likely limited to internet-accessible Microweber deployments running 2.0.15 or earlier with the /search route enabled. The CVE affected-product metadata is incomplete, so asset owners should confirm product and version directly.
Exploitation context
The bundle says unauthenticated remote attackers can inject script or HTML. It does not show CISA KEV status or any cited evidence of active exploitation in the wild.
Researcher notes
Product metadata in the CVE record is incomplete, but the description names Microweber 2.0.15 and earlier. The referenced commit suggests a code change exists; the bundle does not prove which release contains it.
Mitigation direction
- Identify all Microweber deployments and confirm their exact versions.
- Check Microweber guidance for the fixed release associated with the referenced commit.
- Upgrade affected deployments once a vendor-supported fixed version is confirmed.
- Apply temporary input handling or WAF controls only as interim risk reduction.
- Prioritize sites used by administrators or authenticated business users.
Validation and detection
- Inventory public sites for Microweber 2.0.15 or earlier.
- Confirm whether /search accepts user-controlled keywords input.
- Compare deployed code against the referenced Microweber fix commit.
- Review web logs for unusual keywords parameter activity.
- Retest after upgrade or vendor-recommended remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-40101 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N3.92.7CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.2HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://seclists.org/fulldisclosure/2024/Aug/1CVE reference, mitre
- https://github.com/microweber/microweber/commit/0dede6886c6df3d1f31c4f4e3ba1ab4a336fbf79CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.