CVE-2018-0657 Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment...
MediumCVSS 4.8
EPSS 0.52%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and earlier, and GMO-PG Payment Module (PG Multi-Payment Service) (2.11) version 2.3.17 and earlier) allow an attacker with administrator rights to inject arbitrary web script or HTML via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ec-cube payment module | <= 2.3.17 | No fix listed |
| ec-cube payment module | <= 3.5.23 | No fix listed |
| gmo-pg payment module | <= 2.3.17 | No fix listed |
| gmo-pg payment module | <= 3.5.23 | No fix listed |
| GMO Payment Gateway, Inc. EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE | = (EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and | No fix listed |
References
- JVN#06372244 third-party-advisory