« Volver al listado

CVE-2022-40199

Estado: ModificadaBaja (2.7)—

Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated attacker with an administrative privilege to obtain the product's directory structure information.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Ec-cube — Ec-cube

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-40199",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-40199",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-21T18:22:17.185316Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 2.7,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.2
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 2.7,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "EC-CUBE CO.,LTD.",
          "product": "EC-CUBE 3 series and EC-CUBE 4 series",
          "versions": [
            {
              "status": "affected",
              "version": "EC-CUBE 3.0.0 to 3.0.18-p4 and EC-CUBE 4.0.0 to 4.1.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-09-27T23:15:16.207",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN21213852/index.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.ec-cube.net/info/weakness/20220909/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN21213852/index.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.ec-cube.net/info/weakness/20220909/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated attacker with an administrative privilege to obtain the product's directory structure information."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de Salto de Directorio en las series EC-CUBE 3 (EC-CUBE versiones 3.0.0 a 3.0.18-p4 ) y EC-CUBE 4 (EC-CUBE versiones 4.0.0 a 4.1.2) permite a un atacante remoto autenticado con privilegio administrativo obtener la información de la estructura de directorios del producto"
    }
  ],
  "lastModified": "2026-06-17T05:01:05.787",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5CB1CDC4-2EB3-4003-B9C2-A2B0819685C4",
              "versionEndExcluding": "3.0.18",
              "versionStartIncluding": "3.0.0"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D8AAB855-540E-4D14-9BDD-AA377E0EB91A",
              "versionEndIncluding": "4.1.2",
              "versionStartIncluding": "4.0.0"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:3.0.18:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8D6A3FBD-7161-461D-B165-E3BCA42BBB2A"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:3.0.18:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "10F6D9C1-B4F3-44D8-B266-787DA62228E2"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:3.0.18:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B10AA450-F786-4AFD-9F26-9B2E2D57C5C2"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:3.0.18:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8D30A28C-609A-4B6F-B257-7A577133A9FE"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:3.0.18:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7530D411-D883-48E4-8D3F-6E6AEF7398E8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}