Vulnerability Details CVE-2023-25077
Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote authenticated attacker to inject an arbitrary script.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 51.2%
CVSS Severity
CVSS v3 Score 5.4
References
Products affected by CVE-2023-25077
-
cpe:2.3:a:ec-cube:ec-cube:4.0.0
-
cpe:2.3:a:ec-cube:ec-cube:4.0.1
-
cpe:2.3:a:ec-cube:ec-cube:4.0.2
-
cpe:2.3:a:ec-cube:ec-cube:4.0.3
-
cpe:2.3:a:ec-cube:ec-cube:4.0.5
-
cpe:2.3:a:ec-cube:ec-cube:4.0.6
-
cpe:2.3:a:ec-cube:ec-cube:4.1.0
-
cpe:2.3:a:ec-cube:ec-cube:4.1.1
-
cpe:2.3:a:ec-cube:ec-cube:4.1.2
-
cpe:2.3:a:ec-cube:ec-cube:4.2.0