Cross-Site Scripting Vulnerability in EC-CUBE Business Form Output Plugin by EC-CUBE
CVE-2021-20742

6.1MEDIUM

Key Information:

Vendor

Ec-cube Co.,ltd.

Status
Ec-cube Business Form Output Plugin (for Ec-cube 3.0 Series)
Vendor
CVE Published:
22 June 2021

What is CVE-2021-20742?

The EC-CUBE Business Form Output Plugin for the EC-CUBE 3.0 series, prior to version 1.0.1, contains a cross-site scripting vulnerability that allows remote attackers to inject arbitrary scripts through unspecified vectors. This issue poses significant security risks, as it could potentially lead to unauthorized actions and data breaches on affected websites.

Affected Version(s)

EC-CUBE Business form output plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.1

References

https://www.ec-cube.net/products/detail.php?product_id=959
x_refsource_MISC
https://jvn.jp/en/jp/JVN57524494/index.html
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.