Cross-Site Scripting Vulnerability in EC-CUBE Email Newsletter Management Plugin
CVE-2021-20743

6.1MEDIUM

Key Information:

Vendor

Ec-cube Co.,ltd.

Status
Ec-cube Email Newsletters Management Plugin (for Ec-cube 3.0 Series)
Vendor
CVE Published:
22 June 2021

What is CVE-2021-20743?

A cross-site scripting vulnerability exists in the Email newsletters management plugin for EC-CUBE 3.0 series versions prior to 1.0.4. This issue allows remote attackers to inject arbitrary scripts by tricking users into visiting specially crafted pages, enabling them to perform unauthorized actions on behalf of the user.

Affected Version(s)

EC-CUBE Email newsletters management plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.4

References

https://jvn.jp/en/jp/JVN57524494/index.html
x_refsource_MISC
https://www.ec-cube.net/products/detail.php?product_id=960
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.