CVE-2021-20717

Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser.

Affected

EC-CUBE CO.,LTD. · EC-CUBE

CVSS v3.1 NVD

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

2.31% chance of exploitation in the next 30 days, 83rd percentile

Published

2021-05-10

Updated

2024-08-03

Proof-of-concept exploits (1)

• s-index/CVE-2021-207171★ · 2021-05-29

Security advisories

• https://www.ec-cube.net/news/detail.php?news_id=383
• https://www.ec-cube.net/news/detail.php?news_id=384
• https://jvn.jp/en/jp/JVN97554111/index.html
• advisories/GHSA-c8mx-43cq-993w

References

• CVE Record
• NVD entry

Related

• CVE-2014-0160
• CVE-2020-13957
• CVE-2020-28502
• CVE-2021-21341
• CVE-2021-21349
• CVE-2021-41078