EC-CUBE DOM-based cross-site scripting vulnerability

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-38975 · ADVISORY
• EC-CUBE/ec-cube · PACKAGE
• jvn.jp/en/jp/JVN21213852/index.html · WEB
• ec-cube.net/info/weakness/20220909 · WEB
• ec-cube.net/info/weakness/20220909 · Not Applicable

ec-cube/ec-cube のその他の脆弱性

• GHSA-7rhv-h82h-vpjh中 6.7EC-CUBE has a Vulnerability that Allows MFA Bypass in the Administrative Interface
• CVE-2022-40199低 2.7Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a r…
• CVE-2022-25355中 5.3EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated att…
• CVE-2021-20842中 6.5Cross-site request forgery (CSRF) vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication o…
• CVE-2021-20841中 6.5Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access re…