exploitDog

CVE-2022-38975

Опубликовано: 27 сент. 2022

Источник: nvd

CVSS3: 5.4

EPSS Низкий

Описание

DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an administrative user of the product to visit a specially crafted page.

Ссылки

https://jvn.jp/en/jp/JVN21213852/index.html
Third Party Advisory
https://www.ec-cube.net/info/weakness/20220909/
Not Applicable
Patch
Vendor Advisory
https://jvn.jp/en/jp/JVN21213852/index.html
Third Party Advisory
https://www.ec-cube.net/info/weakness/20220909/
Not Applicable
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*

Версия от 4.0.0 (включая) до 4.1.2 (включая)

EPSS

Процентиль: 44%

0.00217

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79

CWE-79

Связанные уязвимости

GHSA-pggw-rqfm-72rh

CVSS3: 5.4

github

больше 3 лет назад

EC-CUBE DOM-based cross-site scripting vulnerability

EPSS

Процентиль: 44%

0.00217

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79

CWE-79