CVE-2022-21179

2022-02-2409:50:27

jpcert

www.cve.org

remote attacker

authentication hijack

administrator

crafted page

mail magazine

template

transmitted history

AI Score

5.1

Confidence

High

EPSS

0.001

Percentile

26.8%

JSON

Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin ‘Mail Magazine Management Plugin’ ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1.0.4 (for EC-CUBE 3 series) allows a remote unauthenticated attacker to hijack the authentication of an administrator via a specially crafted page, and Mail Magazine Templates and/or transmitted history information may be deleted unintendedly.

CNA Affected

[
  {
    "product": "EC-CUBE plugin 'Mail Magazine Management Plugin'",
    "vendor": "EC-CUBE CO.,LTD.",
    "versions": [
      {
        "status": "affected",
        "version": "ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1.0.4 (for EC-CUBE 3 series)"
      }
    ]
  }
]