Cross-site scripting vulnerability in Product List Screen and Product Detail Screen of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote authenticated attacker to inject an arbitrary script.
References
| Link | Resource |
|---|---|
| https://jvn.jp/en/jp/JVN04785663/ | Third Party Advisory |
| https://www.ec-cube.net/info/weakness/20230214/ | Patch Release Notes Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
13 Mar 2023, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.ec-cube.net/info/weakness/20230214/ - Patch, Release Notes, Vendor Advisory | |
| References | (MISC) https://jvn.jp/en/jp/JVN04785663/ - Third Party Advisory | |
| CWE | CWE-79 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| CPE | cpe:2.3:a:ec-cube:ec-cube:4.0.6:p2:*:*:*:*:*:* cpe:2.3:a:ec-cube:ec-cube:4.0.6:p1:*:*:*:*:*:* cpe:2.3:a:ec-cube:ec-cube:4.2.0:*:*:*:*:*:*:* cpe:2.3:a:ec-cube:ec-cube:4.1.2:p1:*:*:*:*:*:* cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:* |
06 Mar 2023, 04:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-03-06 00:15
Updated : 2024-02-04 23:14
NVD link : CVE-2023-22838
Mitre link : CVE-2023-22838
CVE.ORG link : CVE-2023-22838
JSON object : View
Products Affected
ec-cube
- ec-cube
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')