CVE-2018-0657 Cross-site scripting in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE

What is CVE-2018-0657?

CVE-2018-0657 is a medium-severity cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE, published on 7 Sep 2018. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and earlier, and GMO-PG Payment Module (PG Multi-Payment Service) (2.11) version 2.3.17 and earlier) allow an attacker with administrator rights to inject arbitrary web script or HTML via unspecified vectors.

Weakness: CWE-79

Which versions are affected by CVE-2018-0657?

It affects 2 products.

Products include Ec-Cube Ec-Cube Payment Module, Gmo-Pg Gmo-Pg Payment Module.

How do I fix CVE-2018-0657?

No fix has been published for CVE-2018-0657 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2018-0657 being exploited?

There is no known exploitation of CVE-2018-0657 in the wild and no public exploit code.

Other vulnerabilities in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE

• CVE-2018-0658 Code injection in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m5c7-hj9h-wm2m.