Lucene search

JpcertCVE-2022-37346

HistorySep 27, 2022 - 11:15 p.m.

CVE-2022-37346

2022-09-2723:15:14

CWE-434

jpcert

web.nvd.nist.gov

cve-2022-37346

ec-cube

product image bulk upload plugin

file upload vulnerability

remote code execution

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.004

Percentile

74.4%

JSON

EC-CUBE plugin ‘Product Image Bulk Upload Plugin’ 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary files other than image files. If a user with an administrative privilege of EC-CUBE where the vulnerable plugin is installed is led to upload a specially crafted file, an arbitrary script may be executed on the system.

Affected configurations

Nvd

Vulners

Node

ec-cubeproduct_image_bulk_uploadMatch1.0.0ec-cube

ec-cubeproduct_image_bulk_uploadMatch4.1.0ec-cube

VendorProductVersionCPE
ec-cubeproduct_image_bulk_upload1.0.0cpe:2.3:a:ec-cube:product_image_bulk_upload:1.0.0:*:*:*:*:ec-cube:*:*
ec-cubeproduct_image_bulk_upload4.1.0cpe:2.3:a:ec-cube:product_image_bulk_upload:4.1.0:*:*:*:*:ec-cube:*:*

Vendor	Product	Version	CPE
ec-cube	product_image_bulk_upload	1.0.0	cpe:2.3:a:ec-cube:product_image_bulk_upload:1.0.0:::::ec-cube::
ec-cube	product_image_bulk_upload	4.1.0	cpe:2.3:a:ec-cube:product_image_bulk_upload:4.1.0:::::ec-cube::

CNA Affected

[
  {
    "product": "Product Image Bulk Upload Plugin",
    "vendor": "EC-CUBE CO.,LTD.",
    "versions": [
      {
        "status": "affected",
        "version": "1.0.0 and 4.1.0"
      }
    ]
  }
]

References

jvn.jp/en/jp/JVN30900552/index.html

www.ec-cube.net/info/weakness/20220909/product_images_uploader.php

Social References

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.004

Percentile

74.4%

JSON

Related for CVE-2022-37346