Ec-cube 跨站请求伪造漏洞

Ec-cube is an open source e-commerce system from the Japanese company Ec-cube. The EC-CUBE plugin suffers from a cross-site request forgery vulnerability that exists due to insufficient authentication of the HTTP request source. A remote attacker could use this vulnerability to trick a victim int...

EC-CUBE 安全漏洞

Ec-cube is an open source e-commerce system from the Japanese company Ec-cube. A security vulnerability exists in EC-CUBE due to the application improperly handling HTTP Host header values. A remote attacker could exploit this vulnerability to send an email with a forged redistribution password U...

JVN#53871926: EC-CUBE improperly handles HTTP Host header values

EC-CUBE provided by EC-CUBE CO.,LTD. improperly handles HTTP Host header values CWE-913. Impact A remote attacker may direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE users. Solution Apply Workaround Apply the following workaround to avoid...

JVN#67108459: EC-CUBE plugin "Mail Magazine Management Plugin" vulnerable to cross-site request forgery

EC-CUBE plugin "Mail Magazine Management Plugin" provided by EC-CUBE CO.,LTD. contains a cross-site request forgery vulnerability CWE-352. Impact If a user with an administrative privilege views a malicious page while logged in to EC-CUBE which the plugin is installed, Mail Magazine Templates...

EC-CUBE Improper access control in Management screen

Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings via unspecified vectors...

GHSA-JC55-CRG7-PR35 EC-CUBE Improper access control in Management screen

Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings via unspecified vectors...

CVE-2021-20841

Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings via unspecified vectors...

CVE-2021-20842

Cross-site request forgery CSRF vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page...

CVE-2021-20842

Cross-site request forgery CSRF vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page...

CVE-2021-20841

Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page...

Improper access control

Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings via unspecified vectors...

CVE-2021-20842

Cross-site request forgery CSRF vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page...

CVE-2021-20842

EC-CUBE 2 series versions 2.11.0–2.17.1 are affected by a CSRF vulnerability in the admin interface that can hijack the administrator’s session and delete the administrator via a crafted page. The root cause is cross-site request forgery; impact includes administrator deletion and potential confi...

CVE-2021-20841

Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings via unspecified vectors...

CVE-2021-20841

CVE-2021-20841 affects EC-CUBE 2.x (2.11.2–2.17.1). Root cause: improper access control in the Management screen allows a remote authenticated attacker to bypass restrictions and alter system settings via unspecified vectors. Impact: privileges can be abused to change configuration without proper...

CVE-2021-20841: Undefined Security Weakness

Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings via unspecified vectors...

CVE-2021-20842: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page...

PT-2021-14286

Name of the Vulnerable Software and Affected Versions: EC-CUBE 2 series versions 2.11.0 through 2.17.1 Description: A cross-site request forgery CSRF issue allows a remote attacker to hijack the authentication of an Administrator and potentially delete the Administrator account via a specially...

PT-2021-14285

Name of the Vulnerable Software and Affected Versions: EC-CUBE 2 series versions 2.11.2 through 2.17.1 Description: The issue concerns improper access control in the Management screen, allowing a remote authenticated attacker to bypass access restrictions and alter System settings. Recommendation...