If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using the product.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| EC-CUBE CO.,LTD. | EC-CUBE 2 series | affected |
|
Configuration 1 [-]
|
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-44874 | EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using the product. |
Tue, 08 Oct 2024 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Ec-cube ec-cube 2
|
|
| CPEs | cpe:2.3:a:ec-cube:ec-cube_2:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Ec-cube ec-cube 2
|
|
| Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: jpcert
Published:
Updated: 2024-10-08T17:38:02.195Z
Reserved: 2023-08-14T00:40:59.318Z
Link: CVE-2023-40281
Vulnrichment
Updated: 2024-08-02T18:31:53.206Z
NVD
Status : Modified
Published: 2023-08-17T07:15:44.153
Modified: 2024-11-21T08:19:07.793
Link: CVE-2023-40281
Redhat
No data.
OpenCVE Enrichment
No data.