Cross-Site Scripting Vulnerability in EC-CUBE by EC-CUBE
CVE-2021-20750

6.1MEDIUM

Key Information:

Vendor

Ec-cube Co.,ltd.

Status
Ec-cube
Vendor
CVE Published:
28 June 2021

What is CVE-2021-20750?

A cross-site scripting vulnerability in EC-CUBE allows remote attackers to inject arbitrary scripts by tricking users or administrators into visiting a maliciously crafted page. This can lead to unauthorized actions and potential data exposure, highlighting the importance of maintaining secure web applications.

Affected Version(s)

EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series)

References

https://www.ec-cube.net/info/weakness/weakness.php?id=79
x_refsource_MISC
https://www.ec-cube.net/info/weakness/weakness.php?id=78
x_refsource_MISC
https://jvn.jp/en/jp/JVN95292458/index.html
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.