CVE-2018-0657: XSS
Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and earlier, and GMO-PG Payment Module (PG Multi-Payment Service) (2.11) version 2.3.17 and earlier) allow an attacker with administrator rights to inject arbitrary web script or HTML via unspecified vectors.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-0657?
CVE-2018-0657 is a cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module.
Which software versions are affected by CVE-2018-0657?
The affected software versions for CVE-2018-0657 are EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, and GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and earlier.
What is the severity of CVE-2018-0657?
The severity of CVE-2018-0657 is medium with a severity value of 4.8.
How can I fix the cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module?
To fix the cross-site scripting vulnerability, update EC-CUBE Payment Module to version 3.5.24 (or later) and GMO-PG Payment Module to version 3.5.24 (or later).
Where can I find more information about CVE-2018-0657?
You can find more information about CVE-2018-0657 at the following link: [CVE-2018-0657](http://jvn.jp/en/jp/JVN06372244/index.html)