4.8

CVE-2023-40281

EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page.
If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using the product.

Data is provided by the National Vulnerability Database (NVD)
Ec-cube ≫ Ec-cube Version >= 2.11.0 <= 2.11.5
Ec-cube ≫ Ec-cube Version >= 2.12.0 <= 2.12.6
Ec-cube ≫ Ec-cube Version >= 2.13.0 < 2.13.5
Ec-cube ≫ Ec-cube Version >= 2.17.0 < 2.17.2
Ec-cube ≫ Ec-cube Version2.13.5 Update-
Ec-cube ≫ Ec-cube Version2.13.5 Updatepatch1
Ec-cube ≫ Ec-cube Version2.17.2 Update-
Ec-cube ≫ Ec-cube Version2.17.2 Updatepatch1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.35% 0.567
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.8 1.7 2.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://jvn.jp/en/jp/JVN46993816/
Third Party Advisory
https://www.ec-cube.net/info/weakness/20230727/
Patch
Vendor Advisory
Mitigation