CVE-2020-5679

Опубликовано: 03 дек. 2020

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted.

Ссылки

https://jvn.jp/en/jp/JVN24457594/index.html
Third Party Advisory
https://www.ec-cube.net/info/weakness/
Vendor Advisory
https://jvn.jp/en/jp/JVN24457594/index.html
Third Party Advisory
https://www.ec-cube.net/info/weakness/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*

Версия от 3.0.0 (включая) до 3.0.18 (включая)

EPSS

Процентиль: 42%

0.00197

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-1021

Связанные уязвимости

GHSA-rwh8-h525-4jvj