CVE-2024-41924 - CVE House
Back to Database
Status published Unknown CVE-2024-41924

Acceptance of extraneous untrusted data with trusted data vulnerability exists...

Vulnerability Description

Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series. If this vulnerability is exploited, an attacker who obtained the administrative privilege may install an arbitrary PHP package. If the obsolete versions of PHP packages are installed, the product may be affected by some known vulnerabilities.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-41924

Credits & Attribution

No credits recorded in the NVD database.

References

More from EC-CUBE CO.,LTD.

View All →
CVE-2024-41141
Stored cross-site scripting vulnerability exists in EC-CUBE Web API Plugin....
Unknown 0
CVE-2023-46845
EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0...
Unknown 0
CVE-2023-40281
EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in...
Unknown 0
CVE-2023-25077
Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0...
Unknown 0
CVE-2023-22838
Cross-site scripting vulnerability in Product List Screen and Product Detail...
Unknown 0

Affected Vendor

EC-CUBE CO.,LTD.

View all reports →

Affected Software

EC-CUBE 4 series
Vulnerable Versions:
4.0.0 to 4.0.6-p4, 4.1.0 to 4.1.2-p3, and 4.2.0 to 4.2.3

Timeline

Official Publish: July 30th, 2024
Last Modified: March 18th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.