CVE-2021-20735: XSS
Cross-site scripting vulnerability in ETUNA EC-CUBE plugins (Delivery slip number plugin (3.0 series) 1.0.10 and earlier, Delivery slip number csv bulk registration plugin (3.0 series) 1.0.8 and earlier, and Delivery slip number mail plugin (3.0 series) 1.0.8 and earlier) allows remote attackers to inject an arbitrary script by executing a specific operation on the management page of EC-CUBE.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-20735?
CVE-2021-20735 is a cross-site scripting vulnerability in ETUNA EC-CUBE plugins (Delivery slip number plugin 1.0.10 and earlier, Delivery slip number csv bulk registration plugin 1.0.8 and earlier, and Delivery slip number mail plugin 1.0.8 and earlier) that allows remote attackers to...
What is the severity of CVE-2021-20735?
The severity of CVE-2021-20735 is medium with a CVSS score of 6.1.
Which software is affected by CVE-2021-20735?
The ETUNA EC-CUBE plugins affected by CVE-2021-20735 are Delivery slip number plugin (3.0 series) 1.0.10 and earlier, Delivery slip number csv bulk registration plugin (3.0 series) 1.0.8 and earlier, and Delivery slip number mail plugin (3.0 series) 1.0.8 and earlier.
How can I fix CVE-2021-20735?
To fix CVE-2021-20735, update the affected ETUNA EC-CUBE plugins (Delivery slip number plugin, Delivery slip number csv bulk registration plugin, and Delivery slip number mail plugin) to the latest versions.
What is the CWE ID associated with CVE-2021-20735?
The CWE ID associated with CVE-2021-20735 is CWE-79 (Cross-site Scripting).