PT-2023-18496 · Ec Cube · Ec-Cube
志賀 拓馬
+2
·
Publicado
2023-03-05
·
Atualizado
2025-03-07
·
CVE-2023-22438
CVSS v3.1
5.4
Média
| Vetor | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
EC-CUBE versions 2.11.0 through 2.11.5
EC-CUBE versions 2.12.0 through 2.12.6
EC-CUBE versions 2.13.0 through 2.13.5
EC-CUBE versions 2.17.0 through 2.17.2
EC-CUBE versions 3.0.0 through 3.0.18-p5
EC-CUBE versions 4.0.0 through 4.0.6-p2
EC-CUBE versions 4.1.0 through 4.1.2-p1
EC-CUBE version 4.2.0
Description
A cross-site scripting vulnerability in the Contents Management of EC-CUBE allows a remote authenticated attacker to inject an arbitrary script.
Recommendations
For EC-CUBE versions 2.11.0 through 2.11.5, update to a version outside of this range to mitigate the risk.
For EC-CUBE versions 2.12.0 through 2.12.6, update to a version outside of this range to mitigate the risk.
For EC-CUBE versions 2.13.0 through 2.13.5, update to a version outside of this range to mitigate the risk.
For EC-CUBE versions 2.17.0 through 2.17.2, update to a version outside of this range to mitigate the risk.
For EC-CUBE versions 3.0.0 through 3.0.18-p5, update to a version outside of this range to mitigate the risk.
For EC-CUBE versions 4.0.0 through 4.0.6-p2, update to a version outside of this range to mitigate the risk.
For EC-CUBE versions 4.1.0 through 4.1.2-p1, update to a version outside of this range to mitigate the risk.
For EC-CUBE version 4.2.0, update to a version outside of this range to mitigate the risk.
As a temporary workaround, consider restricting access to the Contents Management feature until a patch is available.
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Ec-Cube