« Volver al listado

CVE-2023-40281

Estado: ModificadaMedia (4.8)—

EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using the product.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Ec-cube — Ec-cube

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-40281",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-40281",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-08T17:32:20.274466Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.7
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "EC-CUBE CO.,LTD.",
          "product": "EC-CUBE 2 series",
          "versions": [
            {
              "status": "affected",
              "version": "2.11.0 to 2.17.2-p1"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ec-cube:ec-cube_2:*:*:*:*:*:*:*:*"
          ],
          "vendor": "ec-cube",
          "product": "ec-cube_2",
          "versions": [
            {
              "status": "affected",
              "version": "2.11.0",
              "versionType": "custom",
              "lessThanOrEqual": "2.17.2-p1"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2023-08-17T07:15:44.153",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN46993816/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.ec-cube.net/info/weakness/20230727/",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN46993816/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.ec-cube.net/info/weakness/20230727/",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in \"mail/template\" and \"products/product\" of Management page.\r\nIf this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using the product."
    }
  ],
  "lastModified": "2026-06-17T06:17:01.770",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04878955-7CDF-41E3-9D15-EB0C32897503",
              "versionEndIncluding": "2.11.5",
              "versionStartIncluding": "2.11.0"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "829D5D2D-FC6C-409E-A172-FC5F3CF11313",
              "versionEndIncluding": "2.12.6",
              "versionStartIncluding": "2.12.0"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F9750836-5979-4123-B62A-3423FB40F1C6",
              "versionEndExcluding": "2.13.5",
              "versionStartIncluding": "2.13.0"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C35039E-3E0E-4D9B-9B3C-6FCBE4FA01FA",
              "versionEndExcluding": "2.17.2",
              "versionStartIncluding": "2.17.0"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:2.13.5:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C6F2E99-DBA6-4433-AD29-9D00EAAAA17B"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:2.13.5:patch1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3C5F732-C51A-4586-9C0E-7B88E23F23FD"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:2.17.2:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5AB363C8-0F2E-466A-81D3-536592F4BEC8"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:2.17.2:patch1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B0B798E3-A599-49B8-A820-244EDD94B2C4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}