CVE-2023-46845: EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper…

Description

EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper settings of the template engine Twig included in the product. As a result, arbitrary code may be executed on the server where the product is running by a user with an administrative privilege.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.6% · higher than 75% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

E3

EC-CUBE 3 series · EC-CUBE CO.,LTD.

3.0.0 to 3.0.18-p6 · source: vendor

E4

EC-CUBE 4 series · EC-CUBE CO.,LTD.

4.0.0 to 4.0.6-p3; 4.1.0 to 4.1.2-p2; and 4.2.0 to 4.2.2 · source: vendor

EC

Ec-cube · Ec-cube

3.0.0 through 3.0.18; 4.0.0 through 4.0.6; 4.1.0 through 4.1.2; 4.2.0 before 4.2.3; 3.0.18; 3.0.18; +9 more · source: NVD