EC-CUBE fails to restrict access permissions

Overview EC-CUBE provided by EC-CUBE CO.,LTD. fails to restrict access permissions CWE-284 . EC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership...

CVE-2021-20778

Improper access control vulnerability in EC-CUBE 4.0.6 EC-CUBE 4 series allows a remote attacker to bypass access restriction and obtain sensitive information via unspecified vectors...

CVE-2021-20778

Improper access control vulnerability in EC-CUBE 4.0.6 EC-CUBE 4 series allows a remote attacker to bypass access restriction and obtain sensitive information via unspecified vectors...

Improper access control

Improper access control vulnerability in EC-CUBE 4.0.6 EC-CUBE 4 series allows a remote attacker to bypass access restriction and obtain sensitive information via unspecified vectors...

CVE-2021-20778

Improper access control vulnerability in EC-CUBE 4.0.6 EC-CUBE 4 series allows a remote attacker to bypass access restriction and obtain sensitive information via unspecified vectors...

CVE-2021-20778

CVE-2021-20778 affects EC-CUBE 4.0.6 (EC-CUBE 4 series). The issue is an improper access control allowing a remote attacker to bypass access restrictions and obtain sensitive information via unspecified vectors. Root cause cited as failing to restrict access permissions (CWE-284). A patch is avai...

JVN#57942445: EC-CUBE fails to restrict access permissions

EC-CUBE provided by EC-CUBE CO.,LTD. fails to restrict access permissions CWE-284 . Impact A remote attacker may obtain sensitive information. Solution Update the Softwere Update the software according to the information provided by the developer. The developer has released EC-CUBE 4.0.6-p1 that...

Ec-cube 访问控制错误漏洞

Ec-cube is an open source e-commerce system from the Japanese company Ec-cube. An Access Control Error vulnerability exists in EC-CUBE that stems from the failure to properly restrict access to resources from unauthorized roles. An attacker could exploit this vulnerability to bypass access...

CVE-2021-20750

Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 EC-CUBE 3 series and EC-CUBE 4.0.0 to 4.0.5-p1 EC-CUBE 4 series allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation...

CVE-2021-20751

Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 EC-CUBE 4 series allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation...

CVE-2021-20750

Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 EC-CUBE 3 series and EC-CUBE 4.0.0 to 4.0.5-p1 EC-CUBE 4 series allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation...

CVE-2021-20751

Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 EC-CUBE 4 series allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation...

Cross site scripting

Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 EC-CUBE 3 series and EC-CUBE 4.0.0 to 4.0.5-p1 EC-CUBE 4 series allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation...

Cross site scripting

Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 EC-CUBE 4 series allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation...

CVE-2021-20751

EC-CUBE 4.x (4.0.0 to 4.0.5-p1) contains a cross-site scripting vulnerability that allows a remote attacker to inject arbitrary scripts by luring an administrator or user to a crafted page and prompting a specific operation. The issue affects EC-CUBE 4 series and is documented under CVE-2021-2075...

CVE-2021-20751

Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 EC-CUBE 4 series allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation...

CVE-2021-20750

Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 EC-CUBE 3 series and EC-CUBE 4.0.0 to 4.0.5-p1 EC-CUBE 4 series allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation...

CVE-2021-20750

CVE-2021-20750 affects EC-CUBE 3.x (3.0.0–3.0.18-p2) and EC-CUBE 4.x (4.0.0–4.0.5-p1). The vulnerability is a cross‑site scripting flaw that allows a remote attacker to cause arbitrary script execution by tricking an administrator or user into visiting a specially crafted page and performing a sp...

Ec-Cube Cross-Site Scripting Vulnerability (CNVD-2021-45755)

Ec-Cube is an open source system for creating shopping websites. A cross-site scripting vulnerability exists in Ec-Cube. An attacker can exploit this vulnerability by tricking an administrator into visiting a specially crafted page and performing a specific action to execute arbitrary script on t...

Ec-Cube cross-site scripting vulnerability (CNVD-2021-45754)

Ec-Cube is an open source system for creating shopping websites. A cross-site scripting vulnerability exists in Ec-Cube. An attacker can exploit this vulnerability by tricking an administrator or user into visiting a specially crafted page and performing certain actions to execute arbitrary scrip...