Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

63 vulnerabilities found for EC-CUBE by EC-CUBE CO.,LTD.

JVNDB-2026-000033

Vulnerability from jvndb - Published: 2026-03-05 12:36 - Updated:2026-03-05 12:36
Severity ?
4.9 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Summary
EC-CUBE vulnerable to multi-factor authentication bypass
Details
EC-CUBE provided by EC-CUBE CO.,LTD. contains the following vulnerability.
  • Authentication bypass using an alternate path or channel (CWE-288) - CVE-2026-30777
EC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website
To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000033.html",
  "dc:date": "2026-03-05T12:36+09:00",
  "dcterms:issued": "2026-03-05T12:36+09:00",
  "dcterms:modified": "2026-03-05T12:36+09:00",
  "description": "EC-CUBE provided by EC-CUBE CO.,LTD. contains the following vulnerability.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/288.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eAuthentication bypass using an alternate path or channel (CWE-288) - CVE-2026-30777\u003c/li\u003e\u003c/ul\u003eEC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000033.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.9",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-000033",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN63765888/index.html",
      "@id": "JVN#63765888",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-30777",
      "@id": "CVE-2026-30777",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "EC-CUBE vulnerable to multi-factor authentication bypass"
}

JVNDB-2024-000080

Vulnerability from jvndb - Published: 2024-07-30 13:56 - Updated:2024-07-30 13:56
Severity ?
6.8 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
Summary
EC-CUBE 4 Series improper input validation when installing plugins
Details
EC-CUBE 4 series provided by EC-CUBE CO.,LTD improperly validates inputs when installing plugins (CWE-349). EC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website
To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000080.html",
  "dc:date": "2024-07-30T13:56+09:00",
  "dcterms:issued": "2024-07-30T13:56+09:00",
  "dcterms:modified": "2024-07-30T13:56+09:00",
  "description": "EC-CUBE 4 series provided by EC-CUBE CO.,LTD improperly validates inputs when installing plugins (CWE-349).\r\n\r\nEC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000080.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "6.8",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2024-000080",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN48324254/index.html",
      "@id": "JVN#48324254",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-41924",
      "@id": "CVE-2024-41924",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "EC-CUBE 4 Series improper input validation when installing plugins"
}

JVNDB-2023-000107

Vulnerability from jvndb - Published: 2023-11-07 13:47 - Updated:2024-05-09 17:17
Severity ?
7.2 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
EC-CUBE 3 series and 4 series vulnerable to arbitrary code execution
Details
EC-CUBE 3 series and 4 series provided by EC-CUBE CO.,LTD. contain an arbitrary code execution vulnerability (CWE-94) due to improper settings of the product's template engine "Twig". Takeshi Miura of N.F.Laboratories Inc. reported this vulnerability to EC-CUBE CO.,LTD. EC-CUBE CO.,LTD. Inc. reported this case to JPCERT/CC to notify users of its solution through JVN.
References
Impacted products
Show details on JVN DB website
To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000107.html",
  "dc:date": "2024-05-09T17:17+09:00",
  "dcterms:issued": "2023-11-07T13:47+09:00",
  "dcterms:modified": "2024-05-09T17:17+09:00",
  "description": "EC-CUBE 3 series and 4 series provided by EC-CUBE CO.,LTD. contain an arbitrary code execution vulnerability (CWE-94) due to improper settings of the product\u0027s template engine \"Twig\".\r\n\r\nTakeshi Miura of N.F.Laboratories Inc. reported this vulnerability to EC-CUBE CO.,LTD.\r\nEC-CUBE CO.,LTD. Inc. reported this case to JPCERT/CC to notify users of its solution through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000107.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "6.5",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "7.2",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2023-000107",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN29195731/index.html",
      "@id": "JVN#29195731",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-46845",
      "@id": "CVE-2023-46845",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-46845",
      "@id": "CVE-2023-46845",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-94",
      "@title": "Code Injection(CWE-94)"
    }
  ],
  "title": "EC-CUBE 3 series and 4 series vulnerable to arbitrary code execution"
}

JVNDB-2023-000082

Vulnerability from jvndb - Published: 2023-08-17 15:12 - Updated:2024-03-25 18:07
Severity ?
4.8 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Summary
EC-CUBE 2 series vulnerable to cross-site scripting
Details
EC-CUBE 2 series provided by EC-CUBE CO.,LTD. contains a cross-site scripting vulnerability (CWE-79) in "mail/template" and "products/product" of Management page. Shimamine Taihei of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to EC-CUBE CO.,LTD. and EC-CUBE CO.,LTD. reported it to JPCERT/CC to notify users of its solution through JVN.
References
Impacted products
Show details on JVN DB website
To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000082.html",
  "dc:date": "2024-03-25T18:07+09:00",
  "dcterms:issued": "2023-08-17T15:12+09:00",
  "dcterms:modified": "2024-03-25T18:07+09:00",
  "description": "EC-CUBE 2 series provided by EC-CUBE CO.,LTD. contains a cross-site scripting vulnerability (CWE-79) in \"mail/template\" and \"products/product\" of Management page.\r\n\r\nShimamine Taihei of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to EC-CUBE CO.,LTD. and EC-CUBE CO.,LTD. reported it to JPCERT/CC to notify users of its solution through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000082.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "2.1",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:S/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2023-000082",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN46993816/index.html",
      "@id": "JVN#46993816",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-40281",
      "@id": "CVE-2023-40281",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-40281",
      "@id": "CVE-2023-40281",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "EC-CUBE 2 series vulnerable to cross-site scripting"
}

JVNDB-2023-000019

Vulnerability from jvndb - Published: 2023-02-28 16:38 - Updated:2024-06-10 17:28
Severity ?
5.4 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
Multiple cross-site scripting vulnerabilities in EC-CUBE
Details
EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple cross-site scripting vulnerabilities listed below. * Cross-site scripting vulnerability in Contents Management (CWE-79) - CVE-2023-22438 * Cross-site scripting vulnerability in Authentication Key Settings (CWE-79) - CVE-2023-25077 * Cross-site scripting vulnerability in Product List Screen and Product Detail Screen (CWE-79) - CVE-2023-22838 CVE-2023-22438 Gaku Mochizuki, Taiga Shirakura of Mitsui Bussan Secure Directions, Inc. and Shiga Takuma of BroadBand Security, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2023-25077 Noriaki Iwasaki of Cyber Defense Institute, Inc. reported this vulnerability to EC-CUBE CO.,LTD. and EC-CUBE CO.,LTD. Inc. reported it to JPCERT/CC to notify users of its solution through JVN. CVE-2023-22838 Rei TAKAHASHI of Hashiura Lab., Dept. of Data Science, Nippon Institute of Technology reported this vulnerability to EC-CUBE CO.,LTD. and EC-CUBE CO.,LTD. reported it to JPCERT/CC to notify users of its solution through JVN.
References
Impacted products
Show details on JVN DB website
To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000019.html",
  "dc:date": "2024-06-10T17:28+09:00",
  "dcterms:issued": "2023-02-28T16:38+09:00",
  "dcterms:modified": "2024-06-10T17:28+09:00",
  "description": "EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple cross-site scripting vulnerabilities listed below.\r\n\r\n* Cross-site scripting vulnerability in Contents Management (CWE-79) - CVE-2023-22438\r\n* Cross-site scripting vulnerability in Authentication Key Settings (CWE-79) - CVE-2023-25077\r\n* Cross-site scripting vulnerability in Product List Screen and Product Detail Screen (CWE-79) - CVE-2023-22838\r\n\r\nCVE-2023-22438\r\nGaku Mochizuki, Taiga Shirakura of Mitsui Bussan Secure Directions, Inc. and Shiga Takuma of BroadBand Security, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\n\r\nCVE-2023-25077\r\nNoriaki Iwasaki of Cyber Defense Institute, Inc. reported this vulnerability to EC-CUBE CO.,LTD. and EC-CUBE CO.,LTD. Inc. reported it to JPCERT/CC to notify users of its solution through JVN.\r\n\r\nCVE-2023-22838\r\nRei TAKAHASHI of Hashiura Lab., Dept. of Data Science, Nippon Institute of Technology reported this vulnerability to EC-CUBE CO.,LTD. and EC-CUBE CO.,LTD. reported it to JPCERT/CC to notify users of its solution through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000019.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "3.5",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "5.4",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2023-000019",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN04785663/index.html",
      "@id": "JVN#04785663",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-22438",
      "@id": "CVE-2023-22438",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-25077",
      "@id": "CVE-2023-25077",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-22838",
      "@id": "CVE-2023-22838",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-22438",
      "@id": "CVE-2023-22438",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-22838",
      "@id": "CVE-2023-22838",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-25077",
      "@id": "CVE-2023-25077",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Multiple cross-site scripting vulnerabilities in EC-CUBE"
}

JVNDB-2022-000073

Vulnerability from jvndb - Published: 2022-09-15 16:30 - Updated:2024-06-13 11:09
Severity ?
2.7 (Low) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Summary
Multiple vulnerabilities in EC-CUBE
Details
EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple vulnerabilities listed below. * Directory traversal vulnerability (CWE-22) - CVE-2022-40199 * DOM-based cross-site scripting vulnerability (CWE-79) - CVE-2022-38975 Noriaki Iwasaki of Cyber Defense Institute, Inc. reported these vulnerabilities to EC-CUBE CO.,LTD. and EC-CUBE CO.,LTD. reported them to JPCERT/CC to notify users of the solutions through JVN.
References
Impacted products
Show details on JVN DB website
To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000073.html",
  "dc:date": "2024-06-13T11:09+09:00",
  "dcterms:issued": "2022-09-15T16:30+09:00",
  "dcterms:modified": "2024-06-13T11:09+09:00",
  "description": "EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple vulnerabilities listed below. \r\n  * Directory traversal vulnerability (CWE-22) - CVE-2022-40199 \r\n  * DOM-based cross-site scripting vulnerability (CWE-79) - CVE-2022-38975 \r\n\r\nNoriaki Iwasaki of Cyber Defense Institute, Inc. reported these vulnerabilities to EC-CUBE CO.,LTD. and EC-CUBE CO.,LTD. reported them to JPCERT/CC to notify users of the solutions through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000073.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "4.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
      "@version": "2.0"
    },
    {
      "@score": "2.7",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2022-000073",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN21213852/index.html",
      "@id": "JVN#21213852",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2022-40199",
      "@id": "CVE-2022-40199",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2022-38975",
      "@id": "CVE-2022-38975",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-40199",
      "@id": "CVE-2022-40199",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-38975",
      "@id": "CVE-2022-38975",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Multiple vulnerabilities in EC-CUBE"
}

JVNDB-2022-000015

Vulnerability from jvndb - Published: 2022-02-22 14:22 - Updated:2024-06-21 17:39
Severity ?
3.1 (Low) - cvssV3_0 - CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Summary
EC-CUBE improperly handles HTTP Host header values
Details
EC-CUBE provided by EC-CUBE CO.,LTD. improperly handles HTTP Host header values (CWE-913). EC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website
To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000015.html",
  "dc:date": "2024-06-21T17:39+09:00",
  "dcterms:issued": "2022-02-22T14:22+09:00",
  "dcterms:modified": "2024-06-21T17:39+09:00",
  "description": "EC-CUBE provided by EC-CUBE CO.,LTD. improperly handles HTTP Host header values (CWE-913).\r\n\r\nEC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000015.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "2.6",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "3.1",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2022-000015",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN53871926/index.html",
      "@id": "JVN#53871926",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2022-25355",
      "@id": "CVE-2022-25355",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-25355",
      "@id": "CVE-2022-25355",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "EC-CUBE improperly handles HTTP Host header values"
}

JVNDB-2021-000100

Vulnerability from jvndb - Published: 2021-11-11 15:09 - Updated:2021-11-11 15:09
Severity ?
4.3 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Summary
Multiple vulnerabilities in EC-CUBE 2 series
Details
EC-CUBE 2 series provided by EC-CUBE CO.,LTD. contains multiple vulnerabilities listed below. * Improper access control in Management screen (CWE-284) - CVE-2021-20841 * Cross-site request forgery vulnerability in Management screen (CWE-352) - CVE-2021-20842 EC-CUBE CO.,LTD. reported these vulnerabilities to JPCERT/CC to notify users of the solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website
To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000100.html",
  "dc:date": "2021-11-11T15:09+09:00",
  "dcterms:issued": "2021-11-11T15:09+09:00",
  "dcterms:modified": "2021-11-11T15:09+09:00",
  "description": "EC-CUBE 2 series provided by EC-CUBE CO.,LTD. contains multiple vulnerabilities listed below.\r\n* Improper access control in Management screen (CWE-284) - CVE-2021-20841\r\n* Cross-site request forgery vulnerability in Management screen (CWE-352) - CVE-2021-20842\r\n\r\nEC-CUBE CO.,LTD. reported these vulnerabilities to JPCERT/CC to notify users of the solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000100.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "4.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2021-000100",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN75444925/index.html",
      "@id": "JVN#75444925",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20841",
      "@id": "CVE-2021-20841",
      "@source": "CVE"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20842",
      "@id": "CVE-2021-20842",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20841",
      "@id": "CVE-2021-20841",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20842",
      "@id": "CVE-2021-20842",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-352",
      "@title": "Cross-Site Request Forgery(CWE-352)"
    }
  ],
  "title": "Multiple vulnerabilities in EC-CUBE 2 series"
}

JVNDB-2021-000059

Vulnerability from jvndb - Published: 2021-07-01 15:49 - Updated:2021-07-01 15:49
Severity ?
7.5 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
EC-CUBE fails to restrict access permissions
Details
EC-CUBE provided by EC-CUBE CO.,LTD. fails to restrict access permissions (CWE-284) . EC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website
To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000059.html",
  "dc:date": "2021-07-01T15:49+09:00",
  "dcterms:issued": "2021-07-01T15:49+09:00",
  "dcterms:modified": "2021-07-01T15:49+09:00",
  "description": "EC-CUBE provided by EC-CUBE CO.,LTD. fails to restrict access permissions (CWE-284) .\r\n\r\nEC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000059.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "5.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
      "@version": "2.0"
    },
    {
      "@score": "7.5",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2021-000059",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN57942445/index.html",
      "@id": "JVN#57942445",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20778",
      "@id": "CVE-2021-20778",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20778",
      "@id": "CVE-2021-20778",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    }
  ],
  "title": "EC-CUBE fails to restrict access permissions"
}

JVNDB-2021-000057

Vulnerability from jvndb - Published: 2021-06-23 15:15 - Updated:2021-06-23 15:15
Severity ?
6.1 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Multiple cross-site scripting vulnerabilities in EC-CUBE
Details
EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple cross-site scripting vulnerabilities listed below. *Cross-site scripting vulnerability (CWE-79) - CVE-2021-20750 *Cross-site scripting vulnerability (CWE-79) - CVE-2021-20751 hibiki moriyama of STNet, Incorporated reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website
To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000057.html",
  "dc:date": "2021-06-23T15:15+09:00",
  "dcterms:issued": "2021-06-23T15:15+09:00",
  "dcterms:modified": "2021-06-23T15:15+09:00",
  "description": "EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple cross-site scripting vulnerabilities listed below.\r\n*Cross-site scripting vulnerability (CWE-79) - CVE-2021-20750\r\n*Cross-site scripting vulnerability (CWE-79) - CVE-2021-20751\r\n\r\nhibiki moriyama of STNet, Incorporated reported these vulnerabilities to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000057.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "2.6",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "6.1",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2021-000057",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN95292458/index.html",
      "@id": "JVN#95292458",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20750",
      "@id": "CVE-2021-20750",
      "@source": "CVE"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20751",
      "@id": "CVE-2021-20751",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20750",
      "@id": "CVE-2021-20750",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20751",
      "@id": "CVE-2021-20751",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Multiple cross-site scripting vulnerabilities in EC-CUBE"
}

JVNDB-2021-000035

Vulnerability from jvndb - Published: 2021-05-10 18:08 - Updated:2021-05-10 18:08
Severity ?
7.1 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Summary
EC-CUBE vulnerable to cross-site scripting
Details
EC-CUBE provided by EC-CUBE CO.,LTD. contains a cross-site scripting vulnerability (CWE-79). An arbitrary script may be executed by executing a specific operation on the management page of EC-CUBE. As of 2021 May 10, an attack exploting this vulnerability has been observed in the wild. EC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website
To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000035.html",
  "dc:date": "2021-05-10T18:08+09:00",
  "dcterms:issued": "2021-05-10T18:08+09:00",
  "dcterms:modified": "2021-05-10T18:08+09:00",
  "description": "EC-CUBE provided by EC-CUBE CO.,LTD. contains a cross-site scripting vulnerability (CWE-79).\r\nAn arbitrary script may be executed by executing a specific operation on the management page of EC-CUBE.\r\n\r\nAs of 2021 May 10, an attack exploting this vulnerability has been observed in the wild.\r\n\r\nEC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000035.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "6.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "7.1",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2021-000035",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN97554111/index.html",
      "@id": "JVN#97554111",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20717",
      "@id": "CVE-2021-20717",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20717",
      "@id": "CVE-2021-20717",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/security/ciadr/vul/20210510-jvn.html",
      "@id": "Regarding cross-site scripting vulnerability in EC-CUBE (JVN#97554111)",
      "@source": "IPA SECURITY ALERTS"
    },
    {
      "#text": "https://www.jpcert.or.jp/english/at/2021/at210022.html",
      "@id": "Alert Regarding Cross Site Scripting Vulnerability (CVE-2021-20717) in EC-CUBE",
      "@source": "JPCERT"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "EC-CUBE vulnerable to cross-site scripting"
}

JVNDB-2020-000080

Vulnerability from jvndb - Published: 2020-12-03 18:15 - Updated:2020-12-03 18:15
Severity ?
5.3 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Summary
Multiple vulnerabilities in EC-CUBE
Details
EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple vulnerabilities listed below. * Clickjacking attacks (CWE-1021) - CVE-2020-5679 * Improper input validation (CWE-20) - CVE-2020-5680 EC-CUBE CO.,LTD. reported these vulnerabilities to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website
To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2020/JVNDB-2020-000080.html",
  "dc:date": "2020-12-03T18:15+09:00",
  "dcterms:issued": "2020-12-03T18:15+09:00",
  "dcterms:modified": "2020-12-03T18:15+09:00",
  "description": "EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple vulnerabilities listed below.\r\n* Clickjacking attacks (CWE-1021) - CVE-2020-5679\r\n* Improper input validation (CWE-20) - CVE-2020-5680\r\n\r\nEC-CUBE CO.,LTD. reported these vulnerabilities to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2020/JVNDB-2020-000080.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "5.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
      "@version": "2.0"
    },
    {
      "@score": "5.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2020-000080",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN24457594/index.html",
      "@id": "JVN#24457594",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5679",
      "@id": "CVE-2020-5679",
      "@source": "CVE"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5680",
      "@id": "CVE-2020-5680",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2020-5679",
      "@id": "CVE-2020-5679",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2020-5680",
      "@id": "CVE-2020-5680",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-20",
      "@title": "Improper Input Validation(CWE-20)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Multiple vulnerabilities in EC-CUBE"
}

JVNDB-2020-000039

Vulnerability from jvndb - Published: 2020-06-18 13:48 - Updated:2020-06-18 13:48
Severity ?
4.3 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Summary
EC-CUBE vulnerable to directory traversal
Details
EC-CUBE provided by EC-CUBE CO.,LTD. contains a directory traversal vulnerability (CWE-22). EC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website
To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2020/JVNDB-2020-000039.html",
  "dc:date": "2020-06-18T13:48+09:00",
  "dcterms:issued": "2020-06-18T13:48+09:00",
  "dcterms:modified": "2020-06-18T13:48+09:00",
  "description": "EC-CUBE provided by EC-CUBE CO.,LTD. contains a directory traversal vulnerability (CWE-22).\r\n\r\nEC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN.\r\nJPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2020/JVNDB-2020-000039.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "3.5",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2020-000039",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN77458946/index.html",
      "@id": "JVN#77458946",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5590",
      "@id": "CVE-2020-5590",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2020-5590",
      "@id": "CVE-2020-5590",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    }
  ],
  "title": "EC-CUBE vulnerable to directory traversal"
}

JVNDB-2018-000127

Vulnerability from jvndb - Published: 2018-11-28 17:24 - Updated:2019-08-28 09:42
Severity ?
4.7 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Summary
EC-CUBE vulnerable to open redirect
Details
EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an open redirect vulnerability (CWE-601). LOCKON CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and LOCKON CO.,LTD. coordinated under the Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website
To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000127.html",
  "dc:date": "2019-08-28T09:42+09:00",
  "dcterms:issued": "2018-11-28T17:24+09:00",
  "dcterms:modified": "2019-08-28T09:42+09:00",
  "description": "EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an open redirect vulnerability (CWE-601).\r\n\r\nLOCKON CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and LOCKON CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000127.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "2.6",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.7",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2018-000127",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN25359688/index.html",
      "@id": "JVN#25359688",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16191",
      "@id": "CVE-2018-16191",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2018-16191",
      "@id": "CVE-2018-16191",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-20",
      "@title": "Improper Input Validation(CWE-20)"
    }
  ],
  "title": "EC-CUBE vulnerable to open redirect"
}

JVNDB-2018-000035

Vulnerability from jvndb - Published: 2018-04-17 13:39 - Updated:2018-08-22 17:42
Severity ?
4.2 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Summary
EC-CUBE vulnerable to session fixation
Details
EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a session fixation vulnerability (CWE-384). LOCKON CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and LOCKON CO.,LTD. coordinated under the Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website
To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000035.html",
  "dc:date": "2018-08-22T17:42+09:00",
  "dcterms:issued": "2018-04-17T13:39+09:00",
  "dcterms:modified": "2018-08-22T17:42+09:00",
  "description": "EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a session fixation vulnerability (CWE-384).\r\n\r\nLOCKON CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and LOCKON CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000035.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "5.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.2",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2018-000035",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN52695336/index.html",
      "@id": "JVN#52695336",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0564",
      "@id": "CVE-2018-0564",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2018-0564",
      "@id": "CVE-2018-0564",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "EC-CUBE vulnerable to session fixation"
}

JVNDB-2016-000053

Vulnerability from jvndb - Published: 2016-04-26 14:24 - Updated:2016-05-31 17:40
Severity ?
4.3 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Summary
EC-CUBE vulnerable to cross-site request forgery
Details
EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site request forgery vulnerability (CWE-352). LOCKON CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and LOCKON CO.,LTD. coordinated under the Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website
To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000053.html",
  "dc:date": "2016-05-31T17:40+09:00",
  "dcterms:issued": "2016-04-26T14:24+09:00",
  "dcterms:modified": "2016-05-31T17:40+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site request forgery vulnerability (CWE-352).\r\n\r\nLOCKON CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and LOCKON CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000053.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "2.6",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2016-000053",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN73776243/index.html",
      "@id": "JVN#73776243",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1201",
      "@id": "CVE-2016-1201",
      "@source": "CVE"
    },
    {
      "#text": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1201",
      "@id": "CVE-2016-1201",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-352",
      "@title": "Cross-Site Request Forgery(CWE-352)"
    }
  ],
  "title": "EC-CUBE vulnerable to cross-site request forgery"
}

CVE-2021-20778 (GCVE-0-2021-20778)

Vulnerability from nvd – Published: 2021-07-01 05:45 – Updated: 2024-08-03 17:53
VLAI?
Summary
Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain sensitive information via unspecified vectors.
Severity ?
No CVSS data available.
CWE
  • Improper Access Control
Assigner
References
Impacted products
Vendor Product Version
EC-CUBE CO.,LTD. EC-CUBE Affected: 4.0.6 (EC-CUBE 4 series)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:53:22.168Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=80"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN57942445/index.html"
          },
          {
            "name": "JVN#57942445",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "http://jvn.jp/en/jp/JVN57942445/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EC-CUBE",
          "vendor": "EC-CUBE CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.6 (EC-CUBE 4 series)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain sensitive information via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Access Control",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-07-01T06:06:26.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=80"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN57942445/index.html"
        },
        {
          "name": "JVN#57942445",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "http://jvn.jp/en/jp/JVN57942445/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2021-20778",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EC-CUBE",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "4.0.6 (EC-CUBE 4 series)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "EC-CUBE CO.,LTD."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain sensitive information via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Access Control"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ec-cube.net/info/weakness/weakness.php?id=80",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=80"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN57942445/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN57942445/index.html"
            },
            {
              "name": "JVN#57942445",
              "refsource": "JVN",
              "url": "http://jvn.jp/en/jp/JVN57942445/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2021-20778",
    "datePublished": "2021-07-01T05:45:17.000Z",
    "dateReserved": "2020-12-17T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:53:22.168Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-20751 (GCVE-0-2021-20751)

Vulnerability from nvd – Published: 2021-06-28 00:50 – Updated: 2024-08-03 17:53
VLAI?
Summary
Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation.
Severity ?
No CVSS data available.
CWE
  • Cross-site scripting
Assigner
References
Impacted products
Vendor Product Version
EC-CUBE CO.,LTD. EC-CUBE Affected: EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:53:22.017Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=78"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN95292458/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EC-CUBE",
          "vendor": "EC-CUBE CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-28T00:50:41.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=78"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN95292458/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2021-20751",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EC-CUBE",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "EC-CUBE CO.,LTD."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ec-cube.net/info/weakness/weakness.php?id=78",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=78"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN95292458/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN95292458/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2021-20751",
    "datePublished": "2021-06-28T00:50:41.000Z",
    "dateReserved": "2020-12-17T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:53:22.017Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-20750 (GCVE-0-2021-20750)

Vulnerability from nvd – Published: 2021-06-28 00:50 – Updated: 2024-08-03 17:53
VLAI?
Summary
Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation.
Severity ?
No CVSS data available.
CWE
  • Cross-site scripting
Assigner
References
Impacted products
Vendor Product Version
EC-CUBE CO.,LTD. EC-CUBE Affected: EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:53:21.998Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=79"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=78"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN95292458/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EC-CUBE",
          "vendor": "EC-CUBE CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-28T00:50:39.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=79"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=78"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN95292458/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2021-20750",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EC-CUBE",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "EC-CUBE CO.,LTD."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ec-cube.net/info/weakness/weakness.php?id=79",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=79"
            },
            {
              "name": "https://www.ec-cube.net/info/weakness/weakness.php?id=78",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=78"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN95292458/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN95292458/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2021-20750",
    "datePublished": "2021-06-28T00:50:39.000Z",
    "dateReserved": "2020-12-17T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:53:21.998Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-20717 (GCVE-0-2021-20717)

Vulnerability from nvd – Published: 2021-05-10 09:10 – Updated: 2024-08-03 17:53
VLAI?
Summary
Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser.
Severity ?
No CVSS data available.
CWE
  • Cross-site scripting
Assigner
References
Impacted products
Vendor Product Version
EC-CUBE CO.,LTD. EC-CUBE Affected: 4.0.0 to 4.0.5
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:53:21.816Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/news/detail.php?news_id=384"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/news/detail.php?news_id=383"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN97554111/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EC-CUBE",
          "vendor": "EC-CUBE CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.0 to 4.0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator\u0027s web browser."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-10T09:10:14.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/news/detail.php?news_id=384"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/news/detail.php?news_id=383"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN97554111/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2021-20717",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EC-CUBE",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "4.0.0 to 4.0.5"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "EC-CUBE CO.,LTD."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator\u0027s web browser."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ec-cube.net/news/detail.php?news_id=384",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/news/detail.php?news_id=384"
            },
            {
              "name": "https://www.ec-cube.net/news/detail.php?news_id=383",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/news/detail.php?news_id=383"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN97554111/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN97554111/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2021-20717",
    "datePublished": "2021-05-10T09:10:14.000Z",
    "dateReserved": "2020-12-17T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:53:21.816Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-5680 (GCVE-0-2020-5680)

Vulnerability from nvd – Published: 2020-12-03 11:15 – Updated: 2024-08-04 08:39
VLAI?
Summary
Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vector.
Severity ?
No CVSS data available.
CWE
  • Improper Input Validation
Assigner
References
Impacted products
Vendor Product Version
EC-CUBE CO.,LTD. EC-CUBE Affected: versions from 3.0.5 to 3.0.18
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:39:25.655Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/info/weakness/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN24457594/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EC-CUBE",
          "vendor": "EC-CUBE CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "versions from 3.0.5 to 3.0.18"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vector."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-12-03T11:15:33.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/info/weakness/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN24457594/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2020-5680",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EC-CUBE",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "versions from 3.0.5 to 3.0.18"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "EC-CUBE CO.,LTD."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vector."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Input Validation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ec-cube.net/info/weakness/",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/info/weakness/"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN24457594/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN24457594/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2020-5680",
    "datePublished": "2020-12-03T11:15:33.000Z",
    "dateReserved": "2020-01-06T00:00:00.000Z",
    "dateUpdated": "2024-08-04T08:39:25.655Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-5679 (GCVE-0-2020-5679)

Vulnerability from nvd – Published: 2020-12-03 11:15 – Updated: 2024-08-04 08:39
VLAI?
Summary
Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted.
Severity ?
No CVSS data available.
CWE
  • Improper Restriction of Rendered UI Layers or Frames
Assigner
References
Impacted products
Vendor Product Version
EC-CUBE CO.,LTD. EC-CUBE Affected: versions from 3.0.0 to 3.0.18
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:39:25.580Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/info/weakness/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN24457594/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EC-CUBE",
          "vendor": "EC-CUBE CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "versions from 3.0.0 to 3.0.18"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Restriction of Rendered UI Layers or Frames",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-12-03T11:15:32.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/info/weakness/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN24457594/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2020-5679",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EC-CUBE",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "versions from 3.0.0 to 3.0.18"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "EC-CUBE CO.,LTD."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Restriction of Rendered UI Layers or Frames"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ec-cube.net/info/weakness/",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/info/weakness/"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN24457594/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN24457594/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2020-5679",
    "datePublished": "2020-12-03T11:15:32.000Z",
    "dateReserved": "2020-01-06T00:00:00.000Z",
    "dateUpdated": "2024-08-04T08:39:25.580Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-5590 (GCVE-0-2020-5590)

Vulnerability from nvd – Published: 2020-06-19 09:35 – Updated: 2024-08-04 08:30
VLAI?
Summary
Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors.
Severity ?
No CVSS data available.
CWE
  • Directory traversal
Assigner
References
Impacted products
Vendor Product Version
EC-CUBE CO.,LTD. EC-CUBE Affected: 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:30:24.521Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=73"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=74"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN77458946/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EC-CUBE",
          "vendor": "EC-CUBE CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0 to 3.0.18 and 4.0.0 to 4.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Directory traversal",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-06-19T09:35:18.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=73"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=74"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN77458946/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2020-5590",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EC-CUBE",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "3.0.0 to 3.0.18 and 4.0.0 to 4.0.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "EC-CUBE CO.,LTD."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Directory traversal"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ec-cube.net/info/weakness/weakness.php?id=73",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=73"
            },
            {
              "name": "https://www.ec-cube.net/info/weakness/weakness.php?id=74",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=74"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN77458946/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN77458946/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2020-5590",
    "datePublished": "2020-06-19T09:35:19.000Z",
    "dateReserved": "2020-01-06T00:00:00.000Z",
    "dateUpdated": "2024-08-04T08:30:24.521Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-20778 (GCVE-0-2021-20778)

Vulnerability from cvelistv5 – Published: 2021-07-01 05:45 – Updated: 2024-08-03 17:53
VLAI?
Summary
Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain sensitive information via unspecified vectors.
Severity ?
No CVSS data available.
CWE
  • Improper Access Control
Assigner
References
Impacted products
Vendor Product Version
EC-CUBE CO.,LTD. EC-CUBE Affected: 4.0.6 (EC-CUBE 4 series)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:53:22.168Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=80"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN57942445/index.html"
          },
          {
            "name": "JVN#57942445",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "http://jvn.jp/en/jp/JVN57942445/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EC-CUBE",
          "vendor": "EC-CUBE CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.6 (EC-CUBE 4 series)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain sensitive information via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Access Control",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-07-01T06:06:26.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=80"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN57942445/index.html"
        },
        {
          "name": "JVN#57942445",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "http://jvn.jp/en/jp/JVN57942445/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2021-20778",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EC-CUBE",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "4.0.6 (EC-CUBE 4 series)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "EC-CUBE CO.,LTD."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain sensitive information via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Access Control"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ec-cube.net/info/weakness/weakness.php?id=80",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=80"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN57942445/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN57942445/index.html"
            },
            {
              "name": "JVN#57942445",
              "refsource": "JVN",
              "url": "http://jvn.jp/en/jp/JVN57942445/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2021-20778",
    "datePublished": "2021-07-01T05:45:17.000Z",
    "dateReserved": "2020-12-17T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:53:22.168Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-20751 (GCVE-0-2021-20751)

Vulnerability from cvelistv5 – Published: 2021-06-28 00:50 – Updated: 2024-08-03 17:53
VLAI?
Summary
Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation.
Severity ?
No CVSS data available.
CWE
  • Cross-site scripting
Assigner
References
Impacted products
Vendor Product Version
EC-CUBE CO.,LTD. EC-CUBE Affected: EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:53:22.017Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=78"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN95292458/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EC-CUBE",
          "vendor": "EC-CUBE CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-28T00:50:41.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=78"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN95292458/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2021-20751",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EC-CUBE",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "EC-CUBE CO.,LTD."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ec-cube.net/info/weakness/weakness.php?id=78",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=78"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN95292458/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN95292458/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2021-20751",
    "datePublished": "2021-06-28T00:50:41.000Z",
    "dateReserved": "2020-12-17T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:53:22.017Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-20750 (GCVE-0-2021-20750)

Vulnerability from cvelistv5 – Published: 2021-06-28 00:50 – Updated: 2024-08-03 17:53
VLAI?
Summary
Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation.
Severity ?
No CVSS data available.
CWE
  • Cross-site scripting
Assigner
References
Impacted products
Vendor Product Version
EC-CUBE CO.,LTD. EC-CUBE Affected: EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:53:21.998Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=79"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=78"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN95292458/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EC-CUBE",
          "vendor": "EC-CUBE CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-28T00:50:39.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=79"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=78"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN95292458/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2021-20750",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EC-CUBE",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "EC-CUBE CO.,LTD."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ec-cube.net/info/weakness/weakness.php?id=79",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=79"
            },
            {
              "name": "https://www.ec-cube.net/info/weakness/weakness.php?id=78",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=78"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN95292458/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN95292458/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2021-20750",
    "datePublished": "2021-06-28T00:50:39.000Z",
    "dateReserved": "2020-12-17T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:53:21.998Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-20717 (GCVE-0-2021-20717)

Vulnerability from cvelistv5 – Published: 2021-05-10 09:10 – Updated: 2024-08-03 17:53
VLAI?
Summary
Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser.
Severity ?
No CVSS data available.
CWE
  • Cross-site scripting
Assigner
References
Impacted products
Vendor Product Version
EC-CUBE CO.,LTD. EC-CUBE Affected: 4.0.0 to 4.0.5
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:53:21.816Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/news/detail.php?news_id=384"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/news/detail.php?news_id=383"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN97554111/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EC-CUBE",
          "vendor": "EC-CUBE CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.0 to 4.0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator\u0027s web browser."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-10T09:10:14.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/news/detail.php?news_id=384"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/news/detail.php?news_id=383"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN97554111/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2021-20717",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EC-CUBE",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "4.0.0 to 4.0.5"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "EC-CUBE CO.,LTD."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator\u0027s web browser."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ec-cube.net/news/detail.php?news_id=384",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/news/detail.php?news_id=384"
            },
            {
              "name": "https://www.ec-cube.net/news/detail.php?news_id=383",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/news/detail.php?news_id=383"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN97554111/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN97554111/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2021-20717",
    "datePublished": "2021-05-10T09:10:14.000Z",
    "dateReserved": "2020-12-17T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:53:21.816Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-5680 (GCVE-0-2020-5680)

Vulnerability from cvelistv5 – Published: 2020-12-03 11:15 – Updated: 2024-08-04 08:39
VLAI?
Summary
Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vector.
Severity ?
No CVSS data available.
CWE
  • Improper Input Validation
Assigner
References
Impacted products
Vendor Product Version
EC-CUBE CO.,LTD. EC-CUBE Affected: versions from 3.0.5 to 3.0.18
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:39:25.655Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/info/weakness/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN24457594/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EC-CUBE",
          "vendor": "EC-CUBE CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "versions from 3.0.5 to 3.0.18"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vector."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-12-03T11:15:33.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/info/weakness/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN24457594/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2020-5680",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EC-CUBE",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "versions from 3.0.5 to 3.0.18"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "EC-CUBE CO.,LTD."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vector."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Input Validation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ec-cube.net/info/weakness/",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/info/weakness/"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN24457594/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN24457594/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2020-5680",
    "datePublished": "2020-12-03T11:15:33.000Z",
    "dateReserved": "2020-01-06T00:00:00.000Z",
    "dateUpdated": "2024-08-04T08:39:25.655Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-5679 (GCVE-0-2020-5679)

Vulnerability from cvelistv5 – Published: 2020-12-03 11:15 – Updated: 2024-08-04 08:39
VLAI?
Summary
Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted.
Severity ?
No CVSS data available.
CWE
  • Improper Restriction of Rendered UI Layers or Frames
Assigner
References
Impacted products
Vendor Product Version
EC-CUBE CO.,LTD. EC-CUBE Affected: versions from 3.0.0 to 3.0.18
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:39:25.580Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/info/weakness/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN24457594/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EC-CUBE",
          "vendor": "EC-CUBE CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "versions from 3.0.0 to 3.0.18"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Restriction of Rendered UI Layers or Frames",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-12-03T11:15:32.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/info/weakness/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN24457594/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2020-5679",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EC-CUBE",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "versions from 3.0.0 to 3.0.18"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "EC-CUBE CO.,LTD."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Restriction of Rendered UI Layers or Frames"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ec-cube.net/info/weakness/",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/info/weakness/"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN24457594/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN24457594/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2020-5679",
    "datePublished": "2020-12-03T11:15:32.000Z",
    "dateReserved": "2020-01-06T00:00:00.000Z",
    "dateUpdated": "2024-08-04T08:39:25.580Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-5590 (GCVE-0-2020-5590)

Vulnerability from cvelistv5 – Published: 2020-06-19 09:35 – Updated: 2024-08-04 08:30
VLAI?
Summary
Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors.
Severity ?
No CVSS data available.
CWE
  • Directory traversal
Assigner
References
Impacted products
Vendor Product Version
EC-CUBE CO.,LTD. EC-CUBE Affected: 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:30:24.521Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=73"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=74"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN77458946/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EC-CUBE",
          "vendor": "EC-CUBE CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0 to 3.0.18 and 4.0.0 to 4.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Directory traversal",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-06-19T09:35:18.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=73"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=74"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN77458946/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2020-5590",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EC-CUBE",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "3.0.0 to 3.0.18 and 4.0.0 to 4.0.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "EC-CUBE CO.,LTD."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Directory traversal"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ec-cube.net/info/weakness/weakness.php?id=73",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=73"
            },
            {
              "name": "https://www.ec-cube.net/info/weakness/weakness.php?id=74",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=74"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN77458946/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN77458946/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2020-5590",
    "datePublished": "2020-06-19T09:35:19.000Z",
    "dateReserved": "2020-01-06T00:00:00.000Z",
    "dateUpdated": "2024-08-04T08:30:24.521Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}