CVE-2023-46845 Code injection in EC-CUBE 3 series

High 7.2 Published 7 Nov 2023 Updated 4 Sep 2024

Administrative users can execute arbitrary code on the server due to improper Twig template engine settings in EC-CUBE.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-46845?

CVE-2023-46845 is a high-severity code injection vulnerability in EC-CUBE 3 series, published on 7 Nov 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper settings of the template engine Twig included in the product. As a result, arbitrary code may be executed on the server where the product is running by a user with an administrative privilege.

Weakness: CWE-94

Which versions are affected by CVE-2023-46845?

It affects 1 product.

Products include Ec-Cube Ec-Cube.

How do I fix CVE-2023-46845?

No fix has been published for CVE-2023-46845 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2023-46845 being exploited?

There is no known exploitation of CVE-2023-46845 in the wild and no public exploit code.

Sources

Also known as GHSA-cp9w-gp2m-qfm3.