Cross-Site Scripting Vulnerability in EC-CUBE Payment Modules by EC-CUBE
CVE-2018-0657

4.8MEDIUM

Key Information:

Vendor

Gmo Payment Gateway, Inc.

Status
Ec-cube Payment Module And Gmo-pg Payment Module (pg Multi-payment Service) For Ec-cube
Vendor
CVE Published:
7 September 2018

What is CVE-2018-0657?

The EC-CUBE Payment Module and GMO-PG Payment Module are susceptible to a cross-site scripting vulnerability that allows attackers with administrator rights to inject arbitrary web scripts or HTML through unspecified vectors. This flaw affects specific versions of both modules, potentially compromising the integrity of affected systems and exposing sensitive information.

Affected Version(s)

EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and earlier, and GMO-PG Payment Module (PG Multi-Payment Service) (2.11) version 2.3.17 and earlier)

References

http://jvn.jp/en/jp/JVN06372244/index.html
third-party-advisoryx_refsource_JVN

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.