CVE-2023-46845: Code Injection
First published: Tue Nov 07 2023(Updated: )
EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper settings of the template engine Twig included in the product. As a result, arbitrary code may be executed on the server where the product is running by a user with an administrative privilege.
Credit: vultures@jpcert.or.jp
| Affected Software | Affected Version | How to fix |
|---|---|---|
| EC-CUBE EC-CUBE | >=3.0.0<=3.0.18 | |
| EC-CUBE EC-CUBE | >=4.0.0<=4.0.6 | |
| EC-CUBE EC-CUBE | >=4.1.0<=4.1.2 | |
| EC-CUBE EC-CUBE | >=4.2.0<4.2.3 | |
| EC-CUBE EC-CUBE | =3.0.18-p1 | |
| EC-CUBE EC-CUBE | =3.0.18-p2 | |
| EC-CUBE EC-CUBE | =3.0.18-p3 | |
| EC-CUBE EC-CUBE | =3.0.18-p4 | |
| EC-CUBE EC-CUBE | =3.0.18-p5 | |
| EC-CUBE EC-CUBE | =3.0.18-p6 | |
| EC-CUBE EC-CUBE | =4.0.6-p1 | |
| EC-CUBE EC-CUBE | =4.0.6-p2 | |
| EC-CUBE EC-CUBE | =4.0.6-p3 | |
| EC-CUBE EC-CUBE | =4.1.2-p1 | |
| EC-CUBE EC-CUBE | =4.1.2-p2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-46845?
CVE-2023-46845 is a vulnerability found in EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2). It allows arbitrary code execution due to improper settings of the template engine Twig.
How severe is the CVE-2023-46845 vulnerability?
The severity of CVE-2023-46845 is rated as high with a severity score of 7.2.
How can I fix the CVE-2023-46845 vulnerability?
To fix the CVE-2023-46845 vulnerability, you should update EC-CUBE to version 3.0.19 or higher for 3 series, or version 4.2.3 or higher for 4 series.
Where can I find more information about CVE-2023-46845?
You can find more information about CVE-2023-46845 on the EC-CUBE official website
What is CWE-94?
CWE-94 is the Common Weakness Enumeration category for Improper Control of Generation of Code (Code Injection).
- collector/mitre-cve
- collector/nvd-api
- vendor/ec-cube
- canonical/ec-cube ec-cube
- version/ec-cube ec-cube/3.0.0
- version/ec-cube ec-cube/3.0.18
- version/ec-cube ec-cube/4.0.0
- version/ec-cube ec-cube/4.0.6
- version/ec-cube ec-cube/4.1.0
- version/ec-cube ec-cube/4.1.2
- version/ec-cube ec-cube/4.2.0
- version/ec-cube ec-cube/3.0.18-p1
- version/ec-cube ec-cube/3.0.18-p2
- version/ec-cube ec-cube/3.0.18-p3
- version/ec-cube ec-cube/3.0.18-p4
- version/ec-cube ec-cube/3.0.18-p5
- version/ec-cube ec-cube/3.0.18-p6
- version/ec-cube ec-cube/4.0.6-p1
- version/ec-cube ec-cube/4.0.6-p2
- version/ec-cube ec-cube/4.0.6-p3
- version/ec-cube ec-cube/4.1.2-p1
- version/ec-cube ec-cube/4.1.2-p2