CVE-2022-0896 HIGH

CVE-2022-0896: Improper Neutralization of Special Elements Used in a Template Engine in microweber/microweber

Vendor Microweber
Product microweber/microweber
Weakness CWE-1336
Published March 9, 2022
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Physical
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.0/AV:P/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:H

What the vulnerability does

01Description

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3.

Key dates

02Disclosure timeline

March 9, 2022 CVE published
August 2, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-44209 Banks: Critical Remote Code Execution (RCE) via Jinja2 SSTI CVE-2026-34172 Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment CVE-2026-27629 InvenTree Vulnerable to Server Side Template Injection (SSTI) CVE-2026-42252 Apache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern CVE-2026-40320 Giskard has an Unsandboxed Jinja2 Template Rendering in ConformityCheck