CVE-2023-46845: Code Injection
EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper settings of the template engine Twig included in the product. As a result, arbitrary code may be executed on the server where the product is running by a user with an administrative privilege.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-46845?
CVE-2023-46845 is a vulnerability found in EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2). It allows arbitrary code execution due to improper settings of the template engine Twig.
How severe is the CVE-2023-46845 vulnerability?
The severity of CVE-2023-46845 is rated as high with a severity score of 7.2.
How can I fix the CVE-2023-46845 vulnerability?
To fix the CVE-2023-46845 vulnerability, you should update EC-CUBE to version 3.0.19 or higher for 3 series, or version 4.2.3 or higher for 4 series.
Where can I find more information about CVE-2023-46845?
You can find more information about CVE-2023-46845 on the EC-CUBE official website
What is CWE-94?
CWE-94 is the Common Weakness Enumeration category for Improper Control of Generation of Code (Code Injection).