A critical vulnerability in Microweber CMS 2.0 allows for account compromise due to insufficient password complexity requirements during the reset process.

The application lacks mandatory password length or complexity constraints during password reset operations. This allows unauthenticated attackers or malicious users to set extremely weak credentials, potentially leading to the takeover of administrative accounts.

The ability for attackers to compromise administrative accounts poses a severe risk to organizational data integrity and system availability. With a CVSS score of 8.3, this flaw represents a high risk as it facilitates unauthorized access to the core content management system, which could result in full site defacement or sensitive data exfiltration.

Immediate Action: Since no official patch is currently identified, administrators should manually enforce strong password policies via server-side configuration or custom validation logic to prevent the creation of weak credentials.

Proactive Monitoring: Review user account modification logs for unusual activity and implement rate limiting on password reset endpoints to mitigate potential brute-force or mass-account-compromise attempts.

Compensating Controls: Deploy a Web Application Firewall to monitor for anomalous traffic patterns directed at password reset modules and restrict access to administrative interfaces to known, trusted IP addresses.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub repository referenced in the CVE record.

Given the high CVSS severity and the presence of a public proof-of-concept, organizations must prioritize the hardening of authentication mechanisms within Microweber CMS 2.0. We strongly recommend implementing immediate compensating controls to enforce password complexity until the vendor releases a formal security update to address this logic flaw.