« Volver al listado

CVE-2022-21179

Estado: ModificadaMedia (4.3)—

Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1.0.4 (for EC-CUBE 3 series) allows a remote unauthenticated attacker to hijack the authentication of an administrator via a specially crafted page, and Mail Magazine Templates and/or transmitted history information may be deleted unintendedly.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Ec-cube — E-mail Newsletter Management

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-21179",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "EC-CUBE CO.,LTD.",
          "product": "EC-CUBE plugin 'Mail Magazine Management Plugin'",
          "versions": [
            {
              "status": "affected",
              "version": "ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1.0.4 (for EC-CUBE 3 series)"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-02-24T15:15:27.913",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN67108459/index.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.ec-cube.net/info/weakness/20220221/mail_magazine_plugin.php",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN67108459/index.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.ec-cube.net/info/weakness/20220221/mail_magazine_plugin.php",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1.0.4 (for EC-CUBE 3 series) allows a remote unauthenticated attacker to hijack the authentication of an administrator via a specially crafted page, and Mail Magazine Templates and/or transmitted history information may be deleted unintendedly."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de tipo Cross-site request forgery (CSRF) en el plugin de EC-CUBE \"Mail Magazine Management Plugin\" versiones 4.0.0 a 4.1.1 (para la serie EC-CUBE 4) y versiones 1.0.0 a 1.0.4 (para la serie EC-CUBE 3) permite a un atacante remoto no autenticado secuestrar la autenticación de un administrador por medio de una página especialmente diseñada, y las plantillas de Mail Magazine y/o la información del historial transmitida pueden ser eliminadas involuntariamente"
    }
  ],
  "lastModified": "2026-06-17T04:25:41.230",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ec-cube:e-mail_newsletter_management:*:*:*:*:*:ec-cube:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5A5B3C65-54AD-4FFC-8993-F59C37BA6100",
              "versionEndIncluding": "1.0.4",
              "versionStartIncluding": "1.0.0"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:e-mail_newsletter_management:*:*:*:*:*:ec-cube:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A25900EE-DC3B-4B38-9EC5-C5EEF549EC5F",
              "versionEndIncluding": "4.1.1",
              "versionStartIncluding": "4.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}