CVE-2021-20717: XSS
Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this cross-site scripting vulnerability?
The vulnerability ID of this cross-site scripting vulnerability is CVE-2021-20717.
What is the affected software of this vulnerability?
The affected software of this vulnerability is EC-CUBE version 4.0.0 to 4.0.5.
What is the severity of vulnerability CVE-2021-20717?
The severity of vulnerability CVE-2021-20717 is medium with a CVSS score of 6.1.
How does this vulnerability allow an attacker to exploit it?
This vulnerability allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site, potentially leading to arbitrary script execution on the administrator's web browser.
How can I fix this cross-site scripting vulnerability in EC-CUBE?
To fix this vulnerability, it is recommended to update EC-CUBE to version 4.0.6 or later.