VULNERABILITY INTELLIGENCE

CVE-2023-40281

CVSS score4.8 MEDIUM

EPSS probability0.42%

CISA KEVNot currently listed

Published2023-08-17

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Description

EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using the product.

Weakness classification

nvd@nist.gov: CWE-79

Primary references

vultures@jpcert.or.jp — Third Party Advisory
vultures@jpcert.or.jp — Mitigation, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Patch, Vendor Advisory