CVE-2022-27174

2022-06-1304:50:28

jpcert

www.cve.org

cve-2022-27174

cross-site request forgery

easy blog for ec-cube4

remote attacker

hijack authentication

administrator

delete blog article

delete category

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

26.8%

JSON

Cross-site request forgery (CSRF) vulnerability in Easy Blog for EC-CUBE4 Ver.1.0.1 and earlier allows a remote unauthenticated attacker to hijack the authentication of the administrator and delete a blog article or a category via a specially crafted page.

CNA Affected

[
  {
    "product": "Easy Blog for EC-CUBE4",
    "vendor": "COREMOBILE Co. Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "Ver.1.0.1 and earlier"
      }
    ]
  }
]