Clickjacking Vulnerability in EC-CUBE by EC-CUBE Co., Ltd.
CVE-2020-5679

6.1MEDIUM

Key Information:

Vendor

Ec-cube Co.,ltd.

Status
Ec-cube
Vendor
CVE Published:
3 December 2020

What is CVE-2020-5679?

A clickjacking vulnerability exists in EC-CUBE versions 3.0.0 to 3.0.18 due to insufficient restrictions on rendered UI components. This allows an attacker to manipulate an unsuspecting user's interactions with the admin interface. By tricking users into navigating to a crafted page while logged into the admin area, potential unintended actions could be performed without their knowledge, compromising the security of the system.

Affected Version(s)

EC-CUBE versions from 3.0.0 to 3.0.18

References

https://www.ec-cube.net/info/weakness/
x_refsource_MISC
https://jvn.jp/en/jp/JVN24457594/index.html
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.