CVE-2021-20735
Cross-site scripting vulnerability in ETUNA EC-CUBE plugins (Delivery slip number plugin (3.0 series) 1.0.10 and earlier, Delivery slip number csv bulk registration plugin (3.0 series) 1.0.8 and earlier, and Delivery slip number mail plugin (3.0 series)…
Does this matter?
Lower severity and a low EPSS score (1.12%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting vulnerability in ETUNA EC-CUBE plugins (Delivery slip number plugin (3.0 series) 1.0.10 and earlier, Delivery slip number csv bulk registration plugin (3.0 series) 1.0.8 and earlier, and Delivery slip number mail plugin (3.0 series) 1.0.8 and earlier) allows remote attackers to inject an arbitrary script by executing a specific operation on the management page of EC-CUBE.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 1.12% probability · 64th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- ec-cube/delivery slip number · ec-cube/delivery slip number csv bulk registration · ec-cube/delivery slip number mail
- Source
- vultures@jpcert.or.jp
References
- https://jvn.jp/en/jp/JVN79254445/index.htmlThird Party Advisory
- https://www.ec-cube.net/release/detail.php?release_id=5087Vendor Advisory
- https://www.ec-cube.net/release/detail.php?release_id=5088Vendor Advisory
- https://www.ec-cube.net/release/detail.php?release_id=5089Vendor Advisory
- https://jvn.jp/en/jp/JVN79254445/index.htmlThird Party Advisory
- https://www.ec-cube.net/release/detail.php?release_id=5087Vendor Advisory
- https://www.ec-cube.net/release/detail.php?release_id=5088Vendor Advisory
- https://www.ec-cube.net/release/detail.php?release_id=5089Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.