Lucene search

JpcertCVE-2021-20735

HistoryJun 22, 2021 - 2:15 a.m.

CVE-2021-20735

2021-06-2202:15:07

CWE-79

jpcert

web.nvd.nist.gov

cve-2021-20735

cross-site scripting

etuna ec-cube

plugins

delivery slip number

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.002

Percentile

54.5%

JSON

Cross-site scripting vulnerability in ETUNA EC-CUBE plugins (Delivery slip number plugin (3.0 series) 1.0.10 and earlier, Delivery slip number csv bulk registration plugin (3.0 series) 1.0.8 and earlier, and Delivery slip number mail plugin (3.0 series) 1.0.8 and earlier) allows remote attackers to inject an arbitrary script by executing a specific operation on the management page of EC-CUBE.

Affected configurations

Nvd

Node

ec-cubedelivery_slip_numberRange≤1.0.10ec-cube

ec-cubedelivery_slip_number_csv_bulk_registrationRange≤1.0.8ec-cube

ec-cubedelivery_slip_number_mailRange≤1.0.8ec-cube

VendorProductVersionCPE
ec-cubedelivery_slip_number*cpe:2.3:a:ec-cube:delivery_slip_number:*:*:*:*:*:ec-cube:*:*
ec-cubedelivery_slip_number_csv_bulk_registration*cpe:2.3:a:ec-cube:delivery_slip_number_csv_bulk_registration:*:*:*:*:*:ec-cube:*:*
ec-cubedelivery_slip_number_mail*cpe:2.3:a:ec-cube:delivery_slip_number_mail:*:*:*:*:*:ec-cube:*:*

Vendor	Product	Version	CPE
ec-cube	delivery_slip_number	*	cpe:2.3:a:ec-cube:delivery_slip_number::::::ec-cube::*
ec-cube	delivery_slip_number_csv_bulk_registration	*	cpe:2.3:a:ec-cube:delivery_slip_number_csv_bulk_registration::::::ec-cube::*
ec-cube	delivery_slip_number_mail	*	cpe:2.3:a:ec-cube:delivery_slip_number_mail::::::ec-cube::*

CNA Affected

[
  {
    "product": "ETUNA EC-CUBE plugins",
    "vendor": "ETUNA",
    "versions": [
      {
        "status": "affected",
        "version": "Delivery slip number plugin (3.0 series) 1.0.10 and earlier, Delivery slip number csv bulk registration plugin (3.0 series) 1.0.8 and earlier, and Delivery slip number mail plugin (3.0 series) 1.0.8 and earlier"
      }
    ]
  }
]

References

jvn.jp/en/jp/JVN79254445/index.html

www.ec-cube.net/release/detail.php?release_id=5087

www.ec-cube.net/release/detail.php?release_id=5088

www.ec-cube.net/release/detail.php?release_id=5089

Social References

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.002

Percentile

54.5%

JSON

Related for CVE-2021-20735