CVE-2021-20735 Cross-site scripting in ETUNA EC-CUBE plugins
Remote attackers can inject arbitrary scripts via the management page of ETUNA EC-CUBE delivery slip plugins, potentially compromising admin sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-20735?
CVE-2021-20735 is a medium-severity cross-site scripting vulnerability in ETUNA EC-CUBE plugins, published on 22 Jun 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-site scripting vulnerability in ETUNA EC-CUBE plugins (Delivery slip number plugin (3.0 series) 1.0.10 and earlier, Delivery slip number csv bulk registration plugin (3.0 series) 1.0.8 and earlier, and Delivery slip number mail plugin (3.0 series) 1.0.8 and earlier) allows remote attackers to inject an arbitrary script by executing a specific operation on the management page of EC-CUBE.
Weakness: CWE-79
Which versions are affected by CVE-2021-20735?
It affects 3 products.
Products include Ec-Cube Delivery Slip Number, Ec-Cube Delivery Slip Number Csv Bulk Registration, Ec-Cube Delivery Slip Number Mail.
How do I fix CVE-2021-20735?
No fix has been published for CVE-2021-20735 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-20735 being exploited?
There is no known exploitation of CVE-2021-20735 in the wild and no public exploit code.
Sources
Also known as GHSA-p393-fh7c-vh28.