CVE-2023-40281
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
EC-CUBE versions 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in the 'mail/template' and 'products/product' sections of the Management page. If exploited, an arbitrary script may be executed on the web browser of another administrator or user accessing the website.
Risk Assessment
The organization may be exposed to attacks that could lead to data theft or session hijacking. In particular, administrators may be targeted, which could affect the integrity of the system.
Recommendation
It is recommended to update EC-CUBE to the latest version to mitigate this vulnerability. Additionally, implementing security mechanisms against XSS attacks is advisable.
Original NVD description (English source)
EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using the product.