CVE-2024-41380: Microweber CMS Cross-Site Scripting Vulnerability

CVE-2024-41380 Overview

CVE-2024-41380 is a reflected Cross-Site Scripting (XSS) vulnerability in Microweber 2.0.16, an open-source content management system (CMS). The flaw resides in the userfiles\modules\tags\add_tagging_tagged.php component. Attackers can inject arbitrary JavaScript into affected pages, which executes in the victim's browser when they visit a crafted link. The issue is classified under [CWE-79], improper neutralization of input during web page generation. Exploitation requires user interaction, such as clicking a malicious URL. Successful attacks can lead to session hijacking, credential theft, or unauthorized actions performed in the context of the authenticated user.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling theft of session tokens, defacement, or redirection to attacker-controlled infrastructure.

Affected Products

Microweber CMS version 2.0.16
Component: userfiles\modules\tags\add_tagging_tagged.php
Deployments exposing the tagging module to unauthenticated users

Discovery Timeline

2024-08-05 - CVE-2024-41380 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-41380

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the Microweber tagging module. The add_tagging_tagged.php script processes user-supplied input without applying sufficient output encoding or input sanitization. An attacker crafts a request containing JavaScript payloads in parameters handled by this script. When the response renders, the payload executes in the browser context of the requesting user.

The scope changes from the vulnerable component to the browser session, meaning injected scripts operate under the origin of the Microweber installation. This allows access to cookies, DOM data, and authenticated API endpoints.

Root Cause

The root cause is missing or inadequate contextual output encoding in userfiles\modules\tags\add_tagging_tagged.php. User-controlled data reaches the HTML response without HTML entity encoding. This maps to [CWE-79], improper neutralization of input during web page generation.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker delivers a crafted URL, typically via phishing, chat, or social media, that points to the vulnerable Microweber endpoint. When the victim clicks the link, the server reflects the payload into the response and the browser executes it. No authentication is required to construct the malicious link, though the impact scales with the privileges of the victim viewing it.

Because no verified proof-of-concept is published, defenders should treat the endpoint as reachable to any anonymous internet user. Refer to the GitHub Issue Report for community discussion.

Detection Methods for CVE-2024-41380

Indicators of Compromise

HTTP requests to add_tagging_tagged.php containing URL-encoded <script>, javascript:, onerror=, or onload= sequences
Web server access logs showing unusual referrers or long query strings targeting the tagging module
Outbound browser requests from users to unfamiliar domains immediately after visiting Microweber URLs

Detection Strategies

Deploy a Web Application Firewall (WAF) with rulesets that flag reflected XSS payload patterns targeting Microweber endpoints
Correlate web access logs with browser telemetry to identify script execution originating from reflected parameters
Hunt for anomalous authenticated session activity following user visits to crafted tagging URLs

Monitoring Recommendations

Enable verbose HTTP request logging on the Microweber front-end, capturing full query strings and POST bodies
Alert on repeated 200-OK responses to add_tagging_tagged.php containing HTML control characters in parameters
Monitor for spikes in Content Security Policy (CSP) violation reports if CSP is configured

How to Mitigate CVE-2024-41380

Immediate Actions Required

Restrict access to userfiles\modules\tags\add_tagging_tagged.php via WAF rules or reverse-proxy filtering until a vendor fix is applied
Enforce a strict Content Security Policy (CSP) that disables inline script execution on Microweber-hosted pages
Rotate session cookies and administrator credentials if suspicious access is detected in logs

Patch Information

At the time of writing, no vendor patch is referenced in the NVD entry beyond the tracking issue at the Microweber GitHub Issue Report. Administrators should monitor upstream releases and apply any security update that addresses the tagging module output encoding.

Workarounds

Configure the web server to reject requests to the tagging endpoint containing HTML metacharacters such as <, >, and "
Set the HttpOnly and SameSite=Strict flags on all session cookies to reduce impact of script execution
Require authentication in front of the tagging module using web server access controls until an official fix is available

bash

# Example nginx rule to block obvious XSS payloads targeting the vulnerable endpoint
location ~* /userfiles/modules/tags/add_tagging_tagged\.php {
    if ($args ~* "(<|%3C)script|javascript:|onerror=|onload=") {
        return 403;
    }
}