EC-CUBE 3 series and EC-CUBE 4 series vulnerabilities

Product

EC-CUBE 3 series and EC-CUBE 4 series

by EC-CUBE CO.,LTD. · last CVE Sep 27, 2022

CVEs

On KEV

5.3

Max CVSS

New 30D

Severity mix

Critical 0High 0Medium 1Low 1

Severity

Exploitation

Watch

Add EC-CUBE 3 series and EC-CUBE 4 series to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2022-25355	5.3	1%	Feb 24	EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version… Affected: EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1
CVE-2022-40199	2.7	1%	Sep 27	Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated attacker with an… Affected: EC-CUBE 3.0.0 to 3.0.18-p4 and EC-CUBE 4.0.0 to 4.1.2