[Japanese]

JVNDB-2024-000080

EC-CUBE 4 Series improper input validation when installing plugins

Overview

EC-CUBE 4 series provided by EC-CUBE CO.,LTD improperly validates inputs when installing plugins (CWE-349).

EC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 6.8 (Medium) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Changed
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None
Affected Products


EC-CUBE CO.,LTD.
  • EC-CUBE 4.0.0 to 4.0.6-p4
  • EC-CUBE 4.1.0 to 4.1.2-p3
  • EC-CUBE 4.2.0 to 4.2.3

Impact

An attacker who obtained the administrative privilege may install an arbitrary PHP package. If the obsolete versions of PHP packages are installed, the product may be affected by some known vulnerabilities.
Solution

[Apply the Patch]
Apply the patch provided by the developer.
For more details, refer to the developer's information.
Vendor Information

EC-CUBE CO.,LTD.
CWE (What is CWE?)

  1. No Mapping(CWE-Other) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2024-41924
References

  1. JVN : JVN#48324254
Revision History

  • [2024/07/30]
      Web page was published

Date Public2024/07/30
Date First Published2024/07/30
Date Last Updated2024/07/30