CVE-2022-21179: CSRF
Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1.0.4 (for EC-CUBE 3 series) allows a remote unauthenticated attacker to hijack the authentication of an administrator via a specially crafted page, and Mail Magazine Templates and/or transmitted history information may be deleted unintendedly.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-21179?
CVE-2022-21179 is a cross-site request forgery (CSRF) vulnerability in the EC-CUBE plugin 'Mail Magazine Management Plugin', allowing a remote unauthenticated attacker to hijack the authentication of an administrator.
How does CVE-2022-21179 affect EC-CUBE?
CVE-2022-21179 affects the EC-CUBE plugin 'Mail Magazine Management Plugin' versions 4.0.0 to 4.1.1 (for EC-CUBE 4 series) and versions 1.0.0 to 1.0.4 (for EC-CUBE 3 series).
What is the severity of CVE-2022-21179?
CVE-2022-21179 has a severity rating of 4.3, which is considered medium.
How can an attacker exploit CVE-2022-21179?
An attacker can exploit CVE-2022-21179 by sending a specially crafted request to hijack the authentication of an administrator in EC-CUBE.
Is there a fix for CVE-2022-21179?
Yes, it is recommended to update the EC-CUBE plugin 'Mail Magazine Management Plugin' to versions 4.1.2 (for EC-CUBE 4 series) and 1.0.5 (for EC-CUBE 3 series) or later to fix CVE-2022-21179.