PT-2023-21418 · Ec Cube · Next Engine Integration Plugin

Tsukada Nobuhisa · Published 2023-05-10 · Updated 2023-05-17 · CVE-2023-27919

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions NEXT ENGINE Integration Plugin (for EC-CUBE 2.0 series) all versions

Description The issue allows a remote unauthenticated attacker to alter the information stored in the system due to an authentication bypass vulnerability.

Recommendations For NEXT ENGINE Integration Plugin (for EC-CUBE 2.0 series) all versions, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-27919

Affected Products

Next Engine Integration Plugin

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2023-27919 · Security Note
• https://main.next-engine.com/Usernotice/detail?id=1054 · Note
• https://jvn.jp/en/jp/JVN50862842 · Note