Cross-site scripting in EC-CUBE 2 series
Priority LOW 22CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using the product.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00418 36th percentileScored 2026-11-08
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| EC-CUBE CO.,LTD. | EC-CUBE 2 series | 2.11.0 to 2.17.2-p1 | — | No fix listed | CNA |
- EC-CUBE 2 series VendorEC-CUBE CO.,LTD. Affected 2.11.0 to 2.17.2-p1 Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:* | 2.11.0 – 2.11.5; 2.12.0 – 2.12.6; 2.13.0 to before 2.13.5; 2.17.0 to before 2.17.2 | Vulnerable | EC-CUBE CO.,LTD. |
| cpe:2.3:a:ec-cube:ec-cube:2.13.5:-:*:*:*:*:*:* | 2.13.5 | Vulnerable | EC-CUBE CO.,LTD. |
| cpe:2.3:a:ec-cube:ec-cube:2.13.5:patch1:*:*:*:*:*:* | 2.13.5 patch1 | Vulnerable | EC-CUBE CO.,LTD. |
| cpe:2.3:a:ec-cube:ec-cube:2.17.2:-:*:*:*:*:*:* | 2.17.2 | Vulnerable | EC-CUBE CO.,LTD. |
| cpe:2.3:a:ec-cube:ec-cube:2.17.2:patch1:*:*:*:*:*:* | 2.17.2 patch1 | Vulnerable | EC-CUBE CO.,LTD. |
- cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:* Versions 2.11.0 – 2.11.5; 2.12.0 – 2.12.6; 2.13.0 to before 2.13.5; 2.17.0 to before 2.17.2 Vulnerable ·EC-CUBE CO.,LTD.
- cpe:2.3:a:ec-cube:ec-cube:2.13.5:-:*:*:*:*:*:* Versions 2.13.5 Vulnerable ·EC-CUBE CO.,LTD.
- cpe:2.3:a:ec-cube:ec-cube:2.13.5:patch1:*:*:*:*:*:* Versions 2.13.5 patch1 Vulnerable ·EC-CUBE CO.,LTD.
- cpe:2.3:a:ec-cube:ec-cube:2.17.2:-:*:*:*:*:*:* Versions 2.17.2 Vulnerable ·EC-CUBE CO.,LTD.
- cpe:2.3:a:ec-cube:ec-cube:2.17.2:patch1:*:*:*:*:*:* Versions 2.17.2 patch1 Vulnerable ·EC-CUBE CO.,LTD.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-40281
- 2026-10-03 Alias added: GHSA-m7gf-q6fm-2r43
References
More EC-CUBE CO.,LTD. Ec-cube vulnerabilities
- TI-2020-04559 Path traversal in EC-CUBE CVSS 3.1HIGH 8.1
- TI-2023-25304 Code injection in EC-CUBE 4 series CVSS 3.1HIGH 7.2
- TI-2021-04004 Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote… CVSS 3.1HIGH 7.5
- TI-2020-04641 Improper input validation in EC-CUBE CVSS 3.1HIGH 7.5
- TI-2008-04745 SQL injection vulnerability in LOCKON CO.,LTD. CVSS 2.0HIGH 7.5
- TI-2008-04326 SQL injection vulnerability in EC-CUBE Ver2 2.1.2a and earlier, and Ver2 RC 2.3.0-rc1 and… CVSS 2.0HIGH 7.5
Sources
- CVE-2023-40281 · CVE Program
- CVE-2023-40281 · NVD
- FIRST EPSS
- GHSA-m7gf-q6fm-2r43 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences