CVE-2016-1180: XSS
Published Apr 8, 2016
·Updated
Cross-site scripting (XSS) vulnerability in the Cyber-Will Social-button Premium plugin before 1.1 for EC-CUBE 2.13.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Software
4 affected components
Cyber-Will Social-button Premium Ec-cube<=1.0
EC-CUBE EC-CUBE=2.13.0
EC-CUBE EC-CUBE=2.13.1
EC-CUBE EC-CUBE=2.13.2
Event History
Apr 8, 2016
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-1180?
CVE-2016-1180 has been classified as a moderate severity Cross-site Scripting (XSS) vulnerability.
2
How do I fix CVE-2016-1180?
To fix CVE-2016-1180, upgrade the Cyber-Will Social-button Premium plugin to version 1.1 or higher.
3
What causes CVE-2016-1180?
CVE-2016-1180 is caused by improper input validation allowing for arbitrary web script or HTML injection.
4
Who is affected by CVE-2016-1180?
CVE-2016-1180 affects users of the Cyber-Will Social-button Premium plugin for EC-CUBE versions up to 2.13.x.
5
What types of attacks can CVE-2016-1180 enable?
CVE-2016-1180 can enable remote attackers to execute arbitrary scripts in the context of a user's session.