Lucene search

Japan Vulnerability NotesJVN:22220399

HistoryNov 17, 2023 - 12:00 a.m.

JVN#22220399: Multiple vulnerabilities in CubeCart

2023-11-1700:00:00

Japan Vulnerability Notes

jvn.jp

securitycubecart limitedcross-site request forgerydirectory traversalos command injectioncve-2023-38130cve-2023-42428cve-2023-47283cve-2023-47675update softwareapply workaroundcubecart 6.5.3disable dangerous php functionsprior versions affected

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

8.6 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

35.6%

JSON

CubeCart provided by CubeCart Limited contains multiple vulnerabilities listed below.

Cross-site request forgery (CWE-352) - CVE-2023-38130

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	Base Score: 4.3
CVSS v2	AV:N/AC:H/Au:N/C:N/I:P/A:N	Base Score: 2.6

Directory traversal (CWE-22) - CVE-2023-42428

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N	Base Score: 2.7
CVSS v2	AV:N/AC:L/Au:S/C:N/I:P/A:N	Base Score: 4.0

Directory traversal (CWE-22) - CVE-2023-47283

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N	Base Score: 2.7
CVSS v2	AV:N/AC:L/Au:S/C:P/I:N/A:N	Base Score: 4.0

OS command injection (CWE-78) - CVE-2023-47675

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	Base Score: 9.1
CVSS v2	AV:N/AC:L/Au:S/C:P/I:P/A:P	Base Score: 6.5

Impact

A remote attacker may delete data in the system - CVE-2023-38130
A user with an administrative privilege may delete directories and files in the system - CVE-2023-42428
A user with an administrative privilege may obtain files in the system - CVE-2023-47283
A user with an administrative privilege may execute an arbitrary OS command - CVE-2023-47675

Solution

CVE-2023-38130, CVE-2023-42428, CVE-2023-47283 Update the software
Update the software to the latest version according to the information provided by the developer.
The developer addressed the vulnerabilities in the following versions:

CubeCart 6.5.3
CVE-2023-47675 Apply the Workaround
No fix is available for this vulnerability. The developer recommends disabling the dangerous PHP functions.
The following is the developer’s suggestion to add to php.ini.
disable_functions = exec, system, passthru, pcntl_exec, popen, proc_open, shell_exec

For more information, refer to the information provided by the developer.

Products Affected

CubeCart versions prior to 6.5.3

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

8.6 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

35.6%

JSON

Related for JVN:22220399