Medium severity · published Aug 17, 2023
CVE-2023-40281
EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page
4.8
CVSS
0.4%
EPSS
No
On KEV
Description
EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page.
If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using the product.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
E2
EC-CUBE 2 series · EC-CUBE CO.,LTD.
2.11.0 to 2.17.2-p1 · source: vendor
EC
Ec-cube · Ec-cube
2.11.0 through 2.11.5; 2.12.0 through 2.12.6; 2.13.0 before 2.13.5; 2.17.0 before 2.17.2; 2.13.5; 2.13.5; +2 more · source: NVD
E2
Ec-cube 2 · Ec-cube
2.11.0 through 2.17.2-p1 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-40281
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-40281
Third Party Advisory
https://jvn.jp/en/jp/JVN46993816/
Mitigation
https://www.ec-cube.net/info/weakness/20230727/
More from EC-CUBE 2 series
6.5
CVE-2021-20842
Cross-site request forgery (CSRF) vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete…
6.5
CVE-2021-20841
Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings…