Insufficient File Verification in EC-CUBE Plugin for Image Upload
CVE-2022-37346

9.8CRITICAL

Key Information:

Vendor

Ec-cube Co.,ltd.

Status
Product Image Bulk Upload Plugin
Vendor
CVE Published:
27 September 2022

What is CVE-2022-37346?

The EC-CUBE Product Image Bulk Upload Plugin versions 1.0.0 and 4.1.0 contain a vulnerability due to insufficient verification when handling file uploads. This flaw allows remote, unauthenticated attackers to upload files that are not restricted to image types. If an administrative user inadvertently uploads a specially crafted file, this may lead to the execution of arbitrary scripts on the server, putting the entire system at risk. It is crucial for users and system administrators to address this vulnerability promptly to safeguard their environments.

Affected Version(s)

Product Image Bulk Upload Plugin 1.0.0 and 4.1.0

References

https://www.ec-cube.net/info/weakness/20220909/product_im...
x_refsource_MISC
https://jvn.jp/en/jp/JVN30900552/index.html
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.