PT-2021-14285 · Ec Cube · Ec-Cube

Published 2021-11-24 · Updated 2022-07-12 · CVE-2021-20841

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: EC-CUBE 2 series versions 2.11.2 through 2.17.1

Description: The issue concerns improper access control in the Management screen, allowing a remote authenticated attacker to bypass access restrictions and alter System settings.

Recommendations: For versions 2.11.2 through 2.17.1, update to a version that includes the fix for this issue to prevent unauthorized access and alterations to System settings. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2021-20841

GHSA-JC55-CRG7-PR35

Affected Products

Ec-Cube

References · 7

• 🔥 https://ec-cube.net/info/weakness/20211111 · Exploit
• https://osv.dev/vulnerability/GHSA-jc55-crg7-pr35 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-20841 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20841 · Security Note
• https://github.com/EC-CUBE/ec-cube · Note
• https://jvn.jp/en/jp/JVN75444925/index.html · Note
• https://t.me/cibsecurity/32952 · Telegram Post