JVN#52552792: EC-CUBE vulnerable to cross-site scripting

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a vulnerability in handling the output of parameters, which may result in cross-site scripting.

Impact

When a user accesses a specially crafted URL while there is an item in the shopping cart, an arbitrary script may be executed on the user’s web browser.

Solution

Apply the update or patch
Apply the update or patch according to the information provided by the developer.

Products Affected

• EC-CUBE 2.11.0
• EC-CUBE 2.11.1
• EC-CUBE 2.11.2
• EC-CUBE 2.11.3
• EC-CUBE 2.11.4
• EC-CUBE 2.11.5
• EC-CUBE 2.12.0
• EC-CUBE 2.12.1
• EC-CUBE 2.12.2
• EC-CUBE 2.12.3
• EC-CUBE 2.12.3en
• EC-CUBE 2.12.3enP1
• EC-CUBE 2.12.3enP2