CVE-2018-0657
Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and earlier, and GMO-PG Payment Module (PG Multi-Payment Service) (2.11) version 2.3.17 and earlier) allow an attacker with administrator rights to inject arbitrary web script or HTML via unspecified vectors.
- Score
- CVSS 3.0 4.8 Medium
- Status
- Modified - vultures@jpcert.or.jp
- Published
- 2018-09-07
- Last modified
- 2024-08-05
- Weaknesses
- CWE-79
Affected products
- Ec-cube Payment Module (Ec-cube)
- Gmo-pg Payment Module (Gmo-pg)
- Ec-cube Payment Module And Gmo-pg Payment Module Pg Multi-payment Service For Ec-cube (Gmo Payment Gateway Inc.)
References
- http://jvn.jp/en/jp/JVN06372244/index.html
