CVE-2021-20825: XSS
Published Sep 17, 2021
·Updated
Cross-site scripting vulnerability in List (order management) item change plug-in (for EC-CUBE 3.0 series) Ver.1.1 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors.
Affected Software
2 affected components
shiro8 List \(order Management\) Item Change<=1.1
EC-CUBE EC-CUBE=3.0.0
Event History
Sep 17, 2021
CVE Published
via MITRE·01:40 AM
Data Sourced
via MITRE·01:40 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this cross-site scripting vulnerability?
The vulnerability ID is CVE-2021-20825.
2
What is the affected software for this vulnerability?
The affected software is Shiro8 List (order management) item change plug-in (for EC-CUBE 3.0 series) Ver.1.1 and earlier.
3
How does this vulnerability allow an attacker to inject an arbitrary script?
This vulnerability allows a remote attacker to inject an arbitrary script via unspecified vectors.
4
What is the severity of CVE-2021-20825?
The severity of CVE-2021-20825 is medium with a CVSS score of 6.1.
5
How can I fix this cross-site scripting vulnerability?
To fix this vulnerability, update the Shiro8 List (order management) item change plug-in to version 1.2 or later.