CVE-2023-46845 - CVE House
Back to Database
Status published Unknown CVE-2023-46845

EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0...

Vulnerability Description

EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper settings of the template engine Twig included in the product. As a result, arbitrary code may be executed on the server where the product is running by a user with an administrative privilege.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-46845

Credits & Attribution

No credits recorded in the NVD database.

References

More from EC-CUBE CO.,LTD.

View All →
CVE-2024-41924
Acceptance of extraneous untrusted data with trusted data vulnerability exists...
Unknown 0
CVE-2024-41141
Stored cross-site scripting vulnerability exists in EC-CUBE Web API Plugin....
Unknown 0
CVE-2023-40281
EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in...
Unknown 0
CVE-2023-25077
Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0...
Unknown 0
CVE-2023-22838
Cross-site scripting vulnerability in Product List Screen and Product Detail...
Unknown 0

Affected Vendor

EC-CUBE CO.,LTD.

View all reports →

Affected Software

EC-CUBE 4 series, EC-CUBE 3 series
Vulnerable Versions:
4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2, 3.0.0 to 3.0.18-p6

Timeline

Official Publish: November 7th, 2023
Last Modified: September 4th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.