[Japanese]

JVNDB-2024-000081

EC-CUBE plugin (for EC-CUBE 4 series) "EC-CUBE Web API Plugin" vulnerable to stored cross-site scripting

Overview

EC-CUBE plugin (for EC-CUBE 4 series) "EC-CUBE Web API Plugin" provided by EC-CUBE CO.,LTD. contains a stored cross-site scripting vulnerability (CWE-79) in OAuth Management feature.

EC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 4.8 (Medium) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: Required
  • Scope: Changed
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None
Affected Products


EC-CUBE CO.,LTD.
  • EC-CUBE Web API plugin 1.0.0 and 2.1.0 to 2.1.3 (for EC-CUBE 4.0/4.1 series)
  • EC-CUBE Web API plugin (4.2 series) 4.2.0 to 4.2.3 (for EC-CUBE 4.2 series)

Impact

When there are multiple users using OAuth Management feature and one of them inputs some crafted value on the OAuth Management page, an arbitrary script may be executed on the web browser of the other user who accessed the management page.
Solution

[Update the plugin]
Update the plugin to the latest version according to the information provided by the developer.
Vendor Information

EC-CUBE CO.,LTD.
CWE (What is CWE?)

  1. Cross-site Scripting(CWE-79) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2024-41141
References

  1. JVN : JVN#26225832
Revision History

  • [2024/07/30]
      Web page was published

Date Public2024/07/30
Date First Published2024/07/30
Date Last Updated2024/07/30