JVN#04785663: Multiple cross-site scripting vulnerabilities in EC-CUBE

2023-02-2800:00:00

Japan Vulnerability Notes

jvn.jp

ec-cube

cross-site scripting

vulnerabilities

arbitrary script execution

cwe-79

cve-2023-22438

cve-2023-25077

cve-2023-22838

update

software

workaround

ec-cube 4.2.1

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

38.3%

JSON

EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple cross-site scripting vulnerabilities listed below.

Cross-site scripting vulnerability in Contents Management (CWE-79) - CVE-2023-22438

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	Base Score: 5.4
CVSS v2	AV:N/AC:M/Au:S/C:N/I:P/A:N	Base Score: 3.5

Cross-site scripting vulnerability in Authentication Key Settings (CWE-79) - CVE-2023-25077

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	Base Score: 5.4
CVSS v2	AV:N/AC:M/Au:S/C:N/I:P/A:N	Base Score: 3.5

Cross-site scripting vulnerability in Product List Screen and Product Detail Screen (CWE-79) - CVE-2023-22838

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	Base Score: 5.4
CVSS v2	AV:N/AC:M/Au:S/C:N/I:P/A:N	Base Score: 3.5

Impact

An arbitrary script may be executed on the web browser of the user who is accessing the administrative page of the product - CVE-2023-22438, CVE-2023-25077
An arbitrary script may be executed on the web browser of the user who is accessing a website that uses the product - CVE-2023-22838

Solution

Update the software
Update the software according to the information provided by the developer.
The developer has released EC-CUBE 4.2.1 that addresses these vulnerabilities.

Apply the Workaround
If an update cannot be applied, the developer recommends users applying the patches.
For more information, refer to the information provided by the developer.

Products Affected

CVE-2023-22438

EC-CUBE 4 series
- EC-CUBE 4.0.0 to 4.0.6-p2
- EC-CUBE 4.1.0 to 4.1.2-p1
- EC-CUBE 4.2.0
EC-CUBE 3 series
- EC-CUBE 3.0.0 to 3.0.18-p5
EC-CUBE 2 series
- EC-CUBE 2.11.0 to 2.11.5
- EC-CUBE 2.12.0 to 2.12.6
- EC-CUBE 2.13.0 to 2.13.5
- EC-CUBE 2.17.0 to 2.17.2
  CVE-2023-25077, CVE-2023-22838
EC-CUBE 4 series
- EC-CUBE 4.0.0 to 4.0.6-p2
- EC-CUBE 4.1.0 to 4.1.2-p1
- EC-CUBE 4.2.0