2023-04-24 12:24:31 +02:00
{
"id" : "CVE-2023-22438" ,
"sourceIdentifier" : "vultures@jpcert.or.jp" ,
"published" : "2023-03-06T00:15:10.767" ,
"lastModified" : "2023-03-13T17:17:16.740" ,
"vulnStatus" : "Analyzed" ,
2024-07-14 02:06:08 +00:00
"cveTags" : [ ] ,
2023-04-24 12:24:31 +02:00
"descriptions" : [
{
"lang" : "en" ,
"value" : "Cross-site scripting vulnerability in Contents Management of EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0), EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p5), and EC-CUBE 2 series (EC-CUBE 2.11.0 to 2.11.5, EC-CUBE 2.12.0 to 2.12.6, EC-CUBE 2.13.0 to 2.13.5, and EC-CUBE 2.17.0 to 2.17.2) allows a remote authenticated attacker to inject an arbitrary script."
}
] ,
"metrics" : {
"cvssMetricV31" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" ,
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "LOW" ,
"userInteraction" : "REQUIRED" ,
"scope" : "CHANGED" ,
"confidentialityImpact" : "LOW" ,
"integrityImpact" : "LOW" ,
"availabilityImpact" : "NONE" ,
"baseScore" : 5.4 ,
"baseSeverity" : "MEDIUM"
} ,
"exploitabilityScore" : 2.3 ,
"impactScore" : 2.7
}
]
} ,
"weaknesses" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-79"
}
]
}
] ,
"configurations" : [
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "2.11.0" ,
"versionEndIncluding" : "2.11.5" ,
"matchCriteriaId" : "04878955-7CDF-41E3-9D15-EB0C32897503"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "2.12.0" ,
"versionEndIncluding" : "2.12.6" ,
"matchCriteriaId" : "829D5D2D-FC6C-409E-A172-FC5F3CF11313"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "2.13.0" ,
"versionEndIncluding" : "2.13.5" ,
"matchCriteriaId" : "22BD79CE-BC60-4D68-9CA9-A907C6A0683D"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "2.17.0" ,
"versionEndIncluding" : "2.17.2" ,
"matchCriteriaId" : "271FDC56-FD41-440F-9676-2B6814DEC48A"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "3.0.0" ,
"versionEndIncluding" : "3.0.18" ,
"matchCriteriaId" : "82CF44DC-7824-4C6E-BA58-1B5C929EA7FF"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "4.0.0" ,
"versionEndIncluding" : "4.0.6" ,
"matchCriteriaId" : "DD2386CF-AA07-447D-AEA2-7C8202844E3E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "4.1.0" ,
"versionEndIncluding" : "4.1.2" ,
"matchCriteriaId" : "2482369B-5D65-4C5C-BABE-40AE3ADF2DBE"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:ec-cube:ec-cube:3.0.18:p1:*:*:*:*:*:*" ,
"matchCriteriaId" : "10F6D9C1-B4F3-44D8-B266-787DA62228E2"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:ec-cube:ec-cube:3.0.18:p2:*:*:*:*:*:*" ,
"matchCriteriaId" : "B10AA450-F786-4AFD-9F26-9B2E2D57C5C2"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:ec-cube:ec-cube:3.0.18:p3:*:*:*:*:*:*" ,
"matchCriteriaId" : "8D30A28C-609A-4B6F-B257-7A577133A9FE"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:ec-cube:ec-cube:3.0.18:p4:*:*:*:*:*:*" ,
"matchCriteriaId" : "7530D411-D883-48E4-8D3F-6E6AEF7398E8"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:ec-cube:ec-cube:3.0.18:p5:*:*:*:*:*:*" ,
"matchCriteriaId" : "EC24B844-49C6-48EB-ADE1-4E8B2FA1B230"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:ec-cube:ec-cube:4.0.6:p1:*:*:*:*:*:*" ,
"matchCriteriaId" : "56A84599-1C39-4B65-8256-CE5DE240CF61"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:ec-cube:ec-cube:4.0.6:p2:*:*:*:*:*:*" ,
"matchCriteriaId" : "EC0D4970-06C7-49D7-B249-7ECA1FCF770E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:ec-cube:ec-cube:4.1.2:p1:*:*:*:*:*:*" ,
"matchCriteriaId" : "77DCDC1E-072D-4859-AD9D-1F1547A5C7BB"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:ec-cube:ec-cube:4.2.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "899A469F-AECA-4B58-9287-1FBFBF663B87"
}
]
}
]
}
] ,
"references" : [
{
"url" : "https://jvn.jp/en/jp/JVN04785663/" ,
"source" : "vultures@jpcert.or.jp" ,
"tags" : [
"Third Party Advisory"
]
} ,
{
"url" : "https://www.ec-cube.net/info/weakness/20230214/" ,
"source" : "vultures@jpcert.or.jp" ,
"tags" : [
"Patch" ,
"Release Notes" ,
"Vendor Advisory"
]
} ,
{
"url" : "https://www.ec-cube.net/info/weakness/20230214/index_2.php" ,
"source" : "vultures@jpcert.or.jp" ,
"tags" : [
"Patch" ,
"Release Notes" ,
"Vendor Advisory"
]
} ,
{
"url" : "https://www.ec-cube.net/info/weakness/20230214/index_3.php" ,
"source" : "vultures@jpcert.or.jp" ,
"tags" : [
"Patch" ,
"Release Notes" ,
"Vendor Advisory"
]
}
]
}
