CVE-2024-41141: XSS

Published Jul 30, 2024

Updated

Stored cross-site scripting vulnerability exists in EC-CUBE Web API Plugin. When there are multiple users using OAuth Management feature and one of them inputs some crafted value on the OAuth Management page, an arbitrary script may be executed on the web browser of the other user who accessed the management page.

Affected Software

1 affected component

EC-CUBE Web API Plugin

Event History

Jul 30, 2024

CVE Published

via MITRE·08:45 AM

Data Sourced

via MITRE·08:45 AM

DescriptionWeakness

Data Sourced

via NVD·09:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-41141?

CVE-2024-41141 is classified as a high severity vulnerability due to its potential to execute arbitrary scripts in users' web browsers.

How do I fix CVE-2024-41141?

To fix CVE-2024-41141, update the EC-CUBE Web API Plugin to the latest version that addresses this stored cross-site scripting vulnerability.

What is the impact of CVE-2024-41141?

The impact of CVE-2024-41141 includes the potential for an attacker to execute malicious scripts in the context of another user's session.

Who is affected by CVE-2024-41141?

Users of the EC-CUBE Web API Plugin utilizing the OAuth Management feature are affected by CVE-2024-41141.

Is CVE-2024-41141 a critical vulnerability?

Yes, CVE-2024-41141 is considered critical as it can lead to significant security risks such as user session hijacking.