CVE-2023-40281: XSS
First published: Thu Aug 17 2023(Updated: )
EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using the product.
Credit: vultures@jpcert.or.jp vultures@jpcert.or.jp
| Affected Software | Affected Version | How to fix |
|---|---|---|
| EC-CUBE EC-CUBE | >=2.11.0<=2.11.5 | |
| EC-CUBE EC-CUBE | >=2.12.0<=2.12.6 | |
| EC-CUBE EC-CUBE | >=2.13.0<2.13.5 | |
| EC-CUBE EC-CUBE | >=2.17.0<2.17.2 | |
| EC-CUBE EC-CUBE | =2.13.5 | |
| EC-CUBE EC-CUBE | =2.13.5-patch1 | |
| EC-CUBE EC-CUBE | =2.17.2 | |
| EC-CUBE EC-CUBE | =2.17.2-patch1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2023-40281?
CVE-2023-40281 is a cross-site scripting vulnerability in EC-CUBE 2.11.0 to 2.17.2-p1.
What software versions are affected by CVE-2023-40281?
CVE-2023-40281 affects EC-CUBE versions 2.11.0 to 2.17.2-p1.
What is the severity of CVE-2023-40281?
CVE-2023-40281 has a severity rating of medium with a score of 4.8.
How does CVE-2023-40281 affect the system?
CVE-2023-40281 allows arbitrary script execution on the web browsers of administrators or users.
How can I fix CVE-2023-40281?
To fix CVE-2023-40281, update EC-CUBE to a version higher than 2.17.2-p1 and apply any available patches.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-api
- collector/nvd-index
- vendor/ec-cube
- canonical/ec-cube ec-cube
- version/ec-cube ec-cube/2.11.0
- version/ec-cube ec-cube/2.11.5
- version/ec-cube ec-cube/2.12.0
- version/ec-cube ec-cube/2.12.6
- version/ec-cube ec-cube/2.13.0
- version/ec-cube ec-cube/2.17.0
- version/ec-cube ec-cube/2.13.5
- version/ec-cube ec-cube/2.13.5-patch1
- version/ec-cube ec-cube/2.17.2
- version/ec-cube ec-cube/2.17.2-patch1