CVE-2022-21179 - CVE House
Back to Database
Status published Medium CVE-2022-21179

Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine...

Vulnerability Description

Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1.0.4 (for EC-CUBE 3 series) allows a remote unauthenticated attacker to hijack the authentication of an administrator via a specially crafted page, and Mail Magazine Templates and/or transmitted history information may be deleted unintendedly.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-21179

Credits & Attribution

No credits recorded in the NVD database.

References

More from EC-CUBE CO.,LTD.

View All →
CVE-2024-41924
Acceptance of extraneous untrusted data with trusted data vulnerability exists...
Unknown 0
CVE-2024-41141
Stored cross-site scripting vulnerability exists in EC-CUBE Web API Plugin....
Unknown 0
CVE-2023-46845
EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0...
Unknown 0
CVE-2023-40281
EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in...
Unknown 0
CVE-2023-25077
Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0...
Unknown 0

Affected Vendor

EC-CUBE CO.,LTD.

View all reports →

Affected Software

EC-CUBE plugin 'Mail Magazine Management Plugin'
Vulnerable Versions:
ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1.0.4 (for EC-CUBE 3 series)

Timeline

Official Publish: February 24th, 2022
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.