GitHub Advisoryadvisory · Packagist

GHSA-wgvv-5396-ggvj EC-CUBE XSS Vulnerabilities

MEDIUM Published 2022-05-17 Modified 2024-01-15 Official page ↗
Aliases
CVE-2011-0451
Ecosystem
Packagist
Packages
ec-cube/ec-cube
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2024-01-15

Affected packages

• Packagist ec-cube/ec-cube: < 2.4.4 → fixed in 2.4.4

Description

Multiple cross-site scripting (XSS) vulnerabilities in (1) `data/Smarty/templates/default/list.tpl` and (2) `data/Smarty/templates/default/campaign/bloc/cart_tag.tpl` in EC-CUBE before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Related

Alias · CVE (1)

  • CVE-2011-0451 Multiple cross-site scripting (XSS) vulnerabilities in (1) data/Smarty/templates/default/list.tpl and (2)… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References