Lucene search

JpcertCVE-2022-21179

HistoryFeb 24, 2022 - 3:15 p.m.

CVE-2022-21179

2022-02-2415:15:27

CWE-352

jpcert

web.nvd.nist.gov

cve

2022

21179

csrf

ec-cube

mail magazine management plugin

vulnerability

security

unauthenticated

hijack

authentication

administrator

remote

attack

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

28.7%

JSON

Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin ‘Mail Magazine Management Plugin’ ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1.0.4 (for EC-CUBE 3 series) allows a remote unauthenticated attacker to hijack the authentication of an administrator via a specially crafted page, and Mail Magazine Templates and/or transmitted history information may be deleted unintendedly.

Affected configurations

Nvd

Node

ec-cubee-mail_newsletter_managementRange1.0.0–1.0.4ec-cube

ec-cubee-mail_newsletter_managementRange4.0.0–4.1.1ec-cube

VendorProductVersionCPE
ec-cubee-mail_newsletter_management*cpe:2.3:a:ec-cube:e-mail_newsletter_management:*:*:*:*:*:ec-cube:*:*

Vendor	Product	Version	CPE
ec-cube	e-mail_newsletter_management	*	cpe:2.3:a:ec-cube:e-mail_newsletter_management::::::ec-cube::*

CNA Affected

[
  {
    "product": "EC-CUBE plugin 'Mail Magazine Management Plugin'",
    "vendor": "EC-CUBE CO.,LTD.",
    "versions": [
      {
        "status": "affected",
        "version": "ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1.0.4 (for EC-CUBE 3 series)"
      }
    ]
  }
]

References

jvn.jp/en/jp/JVN67108459/index.html

www.ec-cube.net/info/weakness/20220221/mail_magazine_plugin.php

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

28.7%

JSON

Related for CVE-2022-21179