Lucene search

JpcertCVE-2019-6003

HistorySep 12, 2019 - 5:15 p.m.

CVE-2019-6003

2019-09-1217:15:14

CWE-79

jpcert

web.nvd.nist.gov

cve-2019-6003

cross-site scripting

ec-cube

amazon pay plugin

security vulnerability

remote attack

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

47.1%

JSON

Cross-site scripting vulnerability in EC-CUBE plugin ‘Amazon Pay Plugin 2.12,2.13’ version 2.4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected configurations

Nvd

Node

ec-cubeamazon_payRange≤2.4.2

ec-cubeamazon_payMatch2.12

ec-cubeamazon_payMatch2.13

VendorProductVersionCPE
ec-cubeamazon_pay*cpe:2.3:a:ec-cube:amazon_pay:*:*:*:*:*:*:*:*
ec-cubeamazon_pay2.12cpe:2.3:a:ec-cube:amazon_pay:2.12:*:*:*:*:*:*:*
ec-cubeamazon_pay2.13cpe:2.3:a:ec-cube:amazon_pay:2.13:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ec-cube	amazon_pay	*	cpe:2.3:a:ec-cube:amazon_pay::::::::
ec-cube	amazon_pay	2.12	cpe:2.3:a:ec-cube:amazon_pay:2.12:::::::*
ec-cube	amazon_pay	2.13	cpe:2.3:a:ec-cube:amazon_pay:2.13:::::::*

CNA Affected

[
  {
    "product": "EC-CUBE plugin 'Amazon Pay Plugin 2.12,2.13'",
    "vendor": "LTD.\"",
    "versions": [
      {
        "status": "affected",
        "version": "version 2.4.2 and earlier"
      }
    ]
  }
]

References

jvn.jp/en/jp/JVN29343839/index.html

www.ec-cube.net/products/detail.php?product_id=1602

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

47.1%

JSON

Related for CVE-2019-6003