Riskcovery

CVE-2024-41141

State
Published
Severity
6.1 Medium
Published
Jul 30, 2024
Updated
Nov 6, 2024
Reserved
Jul 24, 2024

Read the record on cve.org

Description

Stored cross-site scripting vulnerability exists in EC-CUBE Web API Plugin. When there are multiple users using OAuth Management feature and one of them inputs some crafted value on the OAuth Management page, an arbitrary script may be executed on the web browser of the other user who accessed the management page.

Scores

CVSSScoreVectorSource
3.16.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCISA-ADP

Weaknesses

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

ProductVersions
EC-CUBE Web API PluginEC-CUBE CO.,LTD.
  • 1.0.0 and 2.1.0 to 2.1.3 (for EC-CUBE 4.0/4.1 series)Affected
EC-CUBE Web API Plugin (4.2 series)EC-CUBE CO.,LTD.
  • 4.2.0 to 4.2.3 (for EC-CUBE 4.2 series)Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.