JVN#46993816: EC-CUBE 2 series vulnerable to cross-site scripting

2023-08-1700:00:00

Japan Vulnerability Notes

jvn.jp

ec-cube

cross-site scripting

cwe-79

patch

security

web browser

administrator

user

product

2.11.0

2.17.2-p1

validation

testing

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

0.0004 Low

EPSS

Percentile

14.1%

JSON

EC-CUBE 2 series provided by EC-CUBE CO.,LTD. contains a cross-site scripting vulnerability (CWE-79) in “mail/template” and “products/product” of Management page.

Impact

An arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using the product.

Solution

Apply the Patch
Apply the patch according to the information provided by the developer.

Products Affected

EC-CUBE 2.11.0 to 2.17.2-p1 (EC-CUBE 2 series)
Since EC-CUBE versions prior to 2.11.0 are no longer supported, therefore the developer has not conduct validation/testing against those versions.