7.2
CVE-2018-0658
- EPSS 0.7%
- Published 07.09.2018 14:29:02
- Last modified 21.11.2024 03:38:40
- Source vultures@jpcert.or.jp
- Teams watchlist Login
- Open Login
Input validation issue in EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.11) version 2.3.17 and earlier allows an attacker with administrative rights to execute arbitrary PHP code on the server via unspecified vectors.
Data is provided by the National Vulnerability Database (NVD)
Ec-cube ≫ Ec-cube Payment Module Version <= 2.3.17
Gmo-pg ≫ Gmo-pg Payment Module Version <= 2.3.17
Ec-cube ≫ Ec-cube Payment Module Version <= 3.5.23
Gmo-pg ≫ Gmo-pg Payment Module Version <= 3.5.23
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.7% | 0.711 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 7.2 | 1.2 | 5.9 |
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 6.5 | 8 | 6.4 |
AV:N/AC:L/Au:S/C:P/I:P/A:P
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.