CVE-2022-0724
Insecure Storage of Sensitive Information in microweber/microweber
Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Insecure Storage of Sensitive Information in microweber/microweber
Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3.
- Record
CVE-2022-0724- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-922
- Updated
- 2026-11-02
EUVDEUVD-2022-1068
Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3.
- Record
EUVD-2022-1068- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j8cx-j9j2-f29w No score
Insecure Storage of Sensitive Information in Microweber
Microweber prior to version 1.3 does not strip images of EXIF data, exposing information about users' locations, device hardware, and device software.
- Record
GHSA-j8cx-j9j2-f29w- Weakness
- CWE-922
- Updated
- 2026-11-02
NVD
Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3.
- Record
CVE-2022-0724- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-922
- Updated
- 2026-11-02
OSV
Insecure Storage of Sensitive Information in microweber/microweber
Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3.
- Record
CVE-2022-0724- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-922
- Updated
- 2026-11-02
OSVGHSA-j8cx-j9j2-f29w No score
Insecure Storage of Sensitive Information in Microweber
Microweber prior to version 1.3 does not strip images of EXIF data, exposing information about users' locations, device hardware, and device software.
- Record
GHSA-j8cx-j9j2-f29w- Weakness
- CWE-922
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
microweber/microweberPackagist |
before 1.3 | 1.3 |
microweber/microweberPackagist |
before 1.3, plus listed versions 0.9.3460.930.9310.9340.951 Show 25 moreShow less1.0.31.0.41.0.51.0.61.0.71.1v1.2.10v1.2.11v1.2.12v1.2.13v1.2.14v1.2.15v1.2.16v1.2.17v1.2.18v1.2.19v1.2.20v1.2.21v1.2.3v1.2.4v1.2.5v1.2.6v1.2.7v1.2.8v1.2.9 |
1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-0724 is a critical vulnerability (CVSS 9.1) in Microweber, published February 23, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.35%, the 71st percentile. Fixed in microweber/microweber 1.3.
References
huntr.dev/bounties/0cdc4a29-dada-4264-b326-8b65b4f11062
github.com/microweber/microweber/commit/b592c86d2b927c0cae5b73b87fb541f25e777aa3
nvd.nist.gov/vuln/detail/CVE-2022-0724