CVE-2023-40281: XSS
Published Aug 17, 2023
·Updated
EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using the product.
Affected Software
8 affected components
EC-CUBE EC-CUBE>=2.11.0<=2.11.5
EC-CUBE EC-CUBE>=2.12.0<=2.12.6
EC-CUBE EC-CUBE>=2.13.0<2.13.5
EC-CUBE EC-CUBE>=2.17.0<2.17.2
EC-CUBE EC-CUBE=2.13.5
EC-CUBE EC-CUBE=2.13.5-patch1
EC-CUBE EC-CUBE=2.17.2
EC-CUBE EC-CUBE=2.17.2-patch1
Remediation
Patch Available
Event History
Aug 17, 2023
CVE Published
via MITRE·06:37 AM
Data Sourced
via MITRE·06:37 AM
DescriptionWeakness
Frequently Asked Questions
1
What is CVE-2023-40281?
CVE-2023-40281 is a cross-site scripting vulnerability in EC-CUBE 2.11.0 to 2.17.2-p1.
2
What software versions are affected by CVE-2023-40281?
CVE-2023-40281 affects EC-CUBE versions 2.11.0 to 2.17.2-p1.
3
What is the severity of CVE-2023-40281?
CVE-2023-40281 has a severity rating of medium with a score of 4.8.
4
How does CVE-2023-40281 affect the system?
CVE-2023-40281 allows arbitrary script execution on the web browsers of administrators or users.
5
How can I fix CVE-2023-40281?
To fix CVE-2023-40281, update EC-CUBE to a version higher than 2.17.2-p1 and apply any available patches.