CVE-2022-25355: Medium severity ec-cube amazon pay vulnerability

Q: What is the vulnerability ID for this EC-CUBE vulnerability?

The vulnerability ID for this EC-CUBE vulnerability is CVE-2022-25355.

Q: What software versions are affected by this vulnerability?

EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 are affected by this vulnerability.

Q: What is the severity of CVE-2022-25355?

The severity of CVE-2022-25355 is medium with a severity value of 5.3.

Q: How does this vulnerability affect EC-CUBE?

This vulnerability in EC-CUBE allows a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with a forged reissue-password URL to EC-CUBE users.

Q: How do I fix CVE-2022-25355?

To fix CVE-2022-25355, update your EC-CUBE software to version 3.0.18-p4 for EC-CUBE 3.x or version 4.2.0 or later for EC-CUBE 4.x.

Published Feb 24, 2022

Updated

EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE users.

Affected Software

8 affected componentsFixes available

composer/ec-cube/ec-cube>=4.0.0<=4.1.1

4.1.2

composer/ec-cube/ec-cube>=3.0.0<=3.0.18-p3

EC-CUBE EC-CUBE>=3.0.0<3.0.18

EC-CUBE EC-CUBE>=4.0.0<=4.1.1

EC-CUBE EC-CUBE=3.0.18

EC-CUBE EC-CUBE=3.0.18-p1

EC-CUBE EC-CUBE=3.0.18-p2

EC-CUBE EC-CUBE=3.0.18-p3

Event History

Feb 24, 2022

CVE Published

via MITRE·09:50 AM

Data Sourced

via MITRE·09:50 AM

DescriptionWeakness

Feb 25, 2022

Advisory Published

via GitHub·12:01 AM

Frequently Asked Questions

What is the vulnerability ID for this EC-CUBE vulnerability?

The vulnerability ID for this EC-CUBE vulnerability is CVE-2022-25355.

What software versions are affected by this vulnerability?

EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 are affected by this vulnerability.

What is the severity of CVE-2022-25355?