« Volver al listado

CVE-2026-30777

Estado: AnalizadaMedia (6.9)—

EC-CUBE provided by EC-CUBE CO.,LTD. contains a multi-factor authentication (MFA) bypass vulnerability. An attacker who has obtained a valid administrator ID and password may be able to bypass two-factor authentication and gain unauthorized access to the administrative page.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Ec-cube — Ec-cube

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-30777",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-30777",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-06T18:19:14.257150Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "vultures@jpcert.or.jp",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 4.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.2
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.2
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "vultures@jpcert.or.jp",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 6.9,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "EC-CUBE CO.,LTD.",
          "product": "EC-CUBE 4.1 series",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 4.1.2-p5"
            }
          ]
        },
        {
          "vendor": "EC-CUBE CO.,LTD.",
          "product": "EC-CUBE 4.2 series",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 4.2.3-p2"
            }
          ]
        },
        {
          "vendor": "EC-CUBE CO.,LTD.",
          "product": "EC-CUBE 4.3 series",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 4.3.1-p1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-05T06:16:51.997",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN63765888/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.ec-cube.net/info/weakness/20260209/index.php",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "vultures@jpcert.or.jp",
      "description": [
        {
          "lang": "en",
          "value": "CWE-288"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "EC-CUBE provided by EC-CUBE CO.,LTD. contains a multi-factor authentication (MFA) bypass vulnerability. An attacker who has obtained a valid administrator ID and password may be able to bypass two-factor authentication and gain unauthorized access to the administrative page."
    },
    {
      "lang": "es",
      "value": "EC-CUBE proporcionado por EC-CUBE CO.,LTD. contiene una vulnerabilidad de omisión de autenticación multifactor (MFA). Un atacante que ha obtenido un ID y contraseña de administrador válidos podría ser capaz de omitir la autenticación de dos factores y obtener acceso no autorizado a la página administrativa."
    }
  ],
  "lastModified": "2026-06-17T10:32:54.487",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:*:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "36FC4D31-98F5-4B83-A403-68A08A18C288",
              "versionEndExcluding": "4.1.2",
              "versionStartIncluding": "4.1.0"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:*:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6601BE42-8CFC-49D1-ACB5-CD5711C72DA5",
              "versionEndExcluding": "4.2.3",
              "versionStartIncluding": "4.2.0"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:*:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "91B2FF2A-AD86-4B83-BCC6-64CEB5FED16B",
              "versionEndExcluding": "4.3.1",
              "versionStartIncluding": "4.3.0"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:4.1.2:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "390C4F1F-9574-423C-A6FC-41945EE72A97"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:4.1.2:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "77DCDC1E-072D-4859-AD9D-1F1547A5C7BB"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:4.1.2:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "833340A1-0C34-4FE6-9820-CBCA7F3DC96C"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:4.1.2:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B3445AF5-EB3D-4E12-A443-7938B8D6283A"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:4.1.2:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8379929D-BC61-46EF-AA01-5154FBEFF658"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:4.2.3:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D2FE8135-3653-4460-AC7F-ED95C184F89F"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:4.2.3:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67D9B2DD-2498-465A-B85A-56EB5A8A13AC"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube:4.3.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "61BF3F86-DD59-4F48-B4CC-E637699F0638"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}