PT-2024-29636 · Ec Cube · Ec-Cube

Published 2024-07-30 · Updated 2025-03-18 · CVE-2024-41924

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EC-CUBE versions 4 series

Description A vulnerability exists where the software accepts extraneous untrusted data alongside trusted data. If exploited, an attacker with administrative privileges may be able to install arbitrary PHP packages. This could potentially lead to the installation of obsolete PHP package versions, which may be affected by known vulnerabilities.

Recommendations For EC-CUBE version 4 series, ensure that only trusted data is accepted and validate all input to prevent the installation of arbitrary PHP packages. As a temporary workaround, consider restricting the installation of PHP packages to only those that are trusted and up-to-date.

Fix

Weakness Enumeration

CWE-349

Related Identifiers

CVE-2024-41924

Affected Products

Ec-Cube

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-41924 · Security Note
• https://t.me/cvedetector/2020 · Telegram Post
• https://ec-cube.net/info/weakness/20240701/index.php · Note
• https://t.me/cvenotify/115251 · Telegram Post
• https://jvn.jp/en/jp/JVN48324254 · Note