CVE-2021-20717

2021-05-1009:10:14

jpcert

www.cve.org

0.005 Low

EPSS

Percentile

75.7%

JSON

Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator’s web browser.

CNA Affected

[
  {
    "product": "EC-CUBE",
    "vendor": "EC-CUBE CO.,LTD.",
    "versions": [
      {
        "status": "affected",
        "version": "4.0.0 to 4.0.5"
      }
    ]
  }
]