PT-2022-14906 · Ec Cube · Mail Magazine Management Plugin+1

山本健太 · Published 2022-02-24 · Updated 2022-03-03 · CVE-2022-21179

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions EC-CUBE plugin 'Mail Magazine Management Plugin' versions 4.0.0 through 4.1.1 (for EC-CUBE 4 series) EC-CUBE plugin 'Mail Magazine Management Plugin' versions 1.0.0 through 1.0.4 (for EC-CUBE 3 series)

Description A cross-site request forgery (CSRF) issue allows a remote unauthenticated attacker to hijack the authentication of an administrator via a specially crafted page. This could result in the unintended deletion of Mail Magazine Templates and/or transmitted history information.

Recommendations For versions 4.0.0 through 4.1.1 (for EC-CUBE 4 series), consider disabling the 'Mail Magazine Management Plugin' until a patch is available to prevent exploitation. For versions 1.0.0 through 1.0.4 (for EC-CUBE 3 series), restrict access to the plugin's functionality to minimize the risk of exploitation. As a temporary workaround, avoid using the plugin's features that may be vulnerable to CSRF attacks until the issue is resolved.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-21179

Affected Products

Ec-Cube

Mail Magazine Management Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-21179 · Security Note
• https://ec-cube.net/info/weakness/20220221/mail_magazine_plugin.php · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21179 · Vendor Advisory
• https://t.me/cvenotify/27721 · Telegram Post
• https://t.me/cibsecurity/38010 · Telegram Post
• https://jvn.jp/en/jp/JVN67108459/index.html · Note