CVE-2019-6003: XSS
Published Sep 12, 2019
·Updated
Cross-site scripting vulnerability in EC-CUBE plugin 'Amazon Pay Plugin 2.12,2.13' version 2.4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Software
3 affected components
EC-CUBE Amazon Pay<=2.4.2
EC-CUBE Amazon Pay=2.12
EC-CUBE Amazon Pay=2.13
Event History
Sep 12, 2019
CVE Published
via MITRE·03:58 PM
Data Sourced
via MITRE·03:58 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID of this cross-site scripting vulnerability?
The vulnerability ID of this cross-site scripting vulnerability is CVE-2019-6003.
2
What is the severity level of CVE-2019-6003?
The severity level of CVE-2019-6003 is medium.
3
How can remote attackers exploit this vulnerability?
Remote attackers can exploit this vulnerability by injecting arbitrary web script or HTML via unspecified vectors.
4
Which version of EC-CUBE plugin Amazon Pay Plugin is affected by this vulnerability?
Version 2.4.2, 2.12, and 2.13 of EC-CUBE plugin Amazon Pay Plugin are affected by this vulnerability.
5
How can I fix this cross-site scripting vulnerability?
To fix this vulnerability, it is recommended to update EC-CUBE plugin Amazon Pay Plugin to a version that includes the necessary security patches.