CVE-2022-38975: XSS
Published Sep 27, 2022
·Updated
DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an administrative user of the product to visit a specially crafted page.
Affected Software
2 affected components
composer/ec-cube/ec-cube>=4.0.0<=4.1.2
EC-CUBE EC-CUBE>=4.0.0<=4.1.2
Remediation
Patch Available
Event History
Sep 27, 2022
CVE Published
via MITRE·01:55 AM
Data Sourced
via MITRE·01:55 AM
DescriptionWeakness
Sep 28, 2022
Advisory Published
via GitHub·12:00 AM
Frequently Asked Questions
1
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2022-38975.
2
What is the severity of CVE-2022-38975?
The severity of CVE-2022-38975 is medium with a score of 5.4.
3
What is the affected software version range for CVE-2022-38975?
The affected software version range for CVE-2022-38975 is EC-CUBE 4.0.0 to 4.1.2.
4
How does CVE-2022-38975 affect EC-CUBE?
CVE-2022-38975 allows a remote attacker to inject arbitrary script into the EC-CUBE 4 series by having an administrative user visit a specially crafted page.
5
How can I fix CVE-2022-38975?
To fix CVE-2022-38975, update EC-CUBE to a version beyond 4.1.2, which addresses the vulnerability.