CVE-2023-22438 - CVE House
Back to Database
Status published Unknown CVE-2023-22438

Cross-site scripting vulnerability in Contents Management of EC-CUBE 4 series...

Vulnerability Description

Cross-site scripting vulnerability in Contents Management of EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0), EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p5), and EC-CUBE 2 series (EC-CUBE 2.11.0 to 2.11.5, EC-CUBE 2.12.0 to 2.12.6, EC-CUBE 2.13.0 to 2.13.5, and EC-CUBE 2.17.0 to 2.17.2) allows a remote authenticated attacker to inject an arbitrary script.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-22438

Credits & Attribution

No credits recorded in the NVD database.

References

More from EC-CUBE CO.,LTD.

View All →
CVE-2024-41924
Acceptance of extraneous untrusted data with trusted data vulnerability exists...
Unknown 0
CVE-2024-41141
Stored cross-site scripting vulnerability exists in EC-CUBE Web API Plugin....
Unknown 0
CVE-2023-46845
EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0...
Unknown 0
CVE-2023-40281
EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in...
Unknown 0
CVE-2023-25077
Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0...
Unknown 0

Affected Vendor

EC-CUBE CO.,LTD.

View all reports →

Affected Software

EC-CUBE 4 series, EC-CUBE 3 series, and EC-CUBE 2 series
Vulnerable Versions:
EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, EC-CUBE 4.2.0, EC-CUBE 3.0.0 to 3.0.18-p5, EC-CUBE 2.11.0 to 2.11.5, EC-CUBE 2.12.0 to 2.12.6, EC-CUBE 2.13.0 to 2.13.5, and EC-CUBE 2.17.0 to 2.17.2

Timeline

Official Publish: March 5th, 2023
Last Modified: March 7th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.