JVN#26621646 EC-CUBE cross-site scripting vulnerability

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site scripting vulnerability.
This vulnerability is different from JVN#61543834, JVN#36085487, and JVN#99916563.

Impact

An arbitrary script could be executed on the user’s web browser.

Solution

Update the Software
Apply the latest updates provided by the vendor.

Products Affected

• EC-CUBE Ver1 Version 1.4.6 and earlier
• EC-CUBE Ver1 Beta Version 1.5.0-beta and earlier
• EC-CUBE Ver2 Version 2.1.2a and earlier
• EC-CUBE Ver2 Beta(RC) Version 2.1.1-beta and earlier
• EC-CUBE Community Edition 1.3.4 and earlier
• EC-CUBE Community Edition Nightly-Build r17336 and earlier