Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2022-21179

Опубликовано: 24 фев. 2022
Источник: nvd
CVSS3: 4.3
CVSS2: 4.3
EPSS Низкий

Описание

Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1.0.4 (for EC-CUBE 3 series) allows a remote unauthenticated attacker to hijack the authentication of an administrator via a specially crafted page, and Mail Magazine Templates and/or transmitted history information may be deleted unintendedly.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ec-cube:e-mail_newsletter_management:*:*:*:*:*:ec-cube:*:*
Версия от 1.0.0 (включая) до 1.0.4 (включая)
cpe:2.3:a:ec-cube:e-mail_newsletter_management:*:*:*:*:*:ec-cube:*:*
Версия от 4.0.0 (включая) до 4.1.1 (включая)

EPSS

Процентиль: 29%
0.00104
Низкий

4.3 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

github логотип

GHSA-qjhc-3x8q-q3vv

github
почти 4 года назад

Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1.0.4 (for EC-CUBE 3 series) allows a remote unauthenticated attacker to hijack the authentication of an administrator via a specially crafted page, and Mail Magazine Templates and/or transmitted history information may be deleted unintendedly.

EPSS

Процентиль: 29%
0.00104
Низкий

4.3 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-352