PT-2018-8996 · Ec Cube+1 · Ec-Cube Payment Module+1

Gen Sato · Publicado 2018-09-07 · Atualizado 2018-11-20 · CVE-2018-0658

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EC-CUBE Payment Module (2.12) versions 3.5.23 and earlier EC-CUBE Payment Module (2.11) versions 2.3.17 and earlier GMO-PG Payment Module (PG Multi-Payment Service) (2.12) versions 3.5.23 and earlier GMO-PG Payment Module (PG Multi-Payment Service) (2.11) versions 2.3.17 and earlier

Description The issue allows an attacker with administrative rights to execute arbitrary PHP code on the server. This can be achieved via unspecified vectors, indicating a potential input validation problem.

Recommendations For EC-CUBE Payment Module (2.12) versions 3.5.23 and earlier, update to a version later than 3.5.23. For EC-CUBE Payment Module (2.11) versions 2.3.17 and earlier, update to a version later than 2.3.17. For GMO-PG Payment Module (PG Multi-Payment Service) (2.12) versions 3.5.23 and earlier, update to a version later than 3.5.23. For GMO-PG Payment Module (PG Multi-Payment Service) (2.11) versions 2.3.17 and earlier, update to a version later than 2.3.17.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-0658

Produtos afetados

Ec-Cube Payment Module

Gmo-Pg Payment Module

Referências · 3

• http://jvn.jp/en/jp/JVN06372244/index.html · Nota
• https://osv.dev/vulnerability/CVE-2018-0658 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-0658 · Nota de Segurança