CVE-2023-22438: XSS
Cross-site scripting vulnerability in Contents Management of EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0), EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p5), and EC-CUBE 2 series (EC-CUBE 2.11.0 to 2.11.5, EC-CUBE 2.12.0 to 2.12.6, EC-CUBE 2.13.0 to 2.13.5, and EC-CUBE 2.17.0 to 2.17.2) allows a remote authenticated attacker to inject an arbitrary script.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-22438?
CVE-2023-22438 is a cross-site scripting vulnerability in the Contents Management of EC-CUBE 4 series, EC-CUBE 3 series, and EC-CUBE 2 series.
Which versions of EC-CUBE are affected by CVE-2023-22438?
EC-CUBE versions 4.0.0 to 4.0.6-p2, 4.1.0 to 4.1.2-p1, and 4.2.0, 3.0.0 to 3.0.18-p5, and 2.11.0 to 2.11.5, 2.12.0 to 2.12.6, 2.13.0 to 2.13.5 are affected by CVE-2023-22438.
How severe is CVE-2023-22438?
CVE-2023-22438 has a severity rating of 5.4 (medium).
What is the Common Weakness Enumeration (CWE) identifier for CVE-2023-22438?
The CWE identifier for CVE-2023-22438 is CWE-79 (Cross-site Scripting).
Where can I find more information about CVE-2023-22438?
You can find more information about CVE-2023-22438 on the JVN website (https://jvn.jp/en/jp/JVN04785663/) and the EC-CUBE website (https://www.ec-cube.net/info/weakness/20230214/).