Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:composer/ec-cube/ec-cube@3.0.18
Typecomposer
Namespaceec-cube
Nameec-cube
Version3.0.18
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version4.0.6-p1
Latest_non_vulnerable_version4.2.3
Affected_by_vulnerabilities
0
url VCID-fuus-wqhf-s3be
vulnerability_id VCID-fuus-wqhf-s3be
summary 
Improper Control of Generation of Code ('Code Injection')
EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper settings of the template engine Twig included in the product. As a result, arbitrary code may be executed on the server where the product is running by a user with an administrative privilege.
references
0
reference_url https://jvn.jp/en/jp/JVN29195731/
reference_id
reference_type
scores
url https://jvn.jp/en/jp/JVN29195731/
1
reference_url https://www.ec-cube.net/info/weakness/20231026/index_3.php
reference_id
reference_type
scores
url https://www.ec-cube.net/info/weakness/20231026/index_3.php
2
reference_url https://www.ec-cube.net/info/weakness/20231026/index_40.php
reference_id
reference_type
scores
url https://www.ec-cube.net/info/weakness/20231026/index_40.php
3
reference_url https://www.ec-cube.net/info/weakness/20231026/index.php
reference_id
reference_type
scores
url https://www.ec-cube.net/info/weakness/20231026/index.php
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-46845
reference_id CVE-2023-46845
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-46845
fixed_packages
0
url pkg:composer/ec-cube/ec-cube@4.0.6-p1
purl pkg:composer/ec-cube/ec-cube@4.0.6-p1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/ec-cube/ec-cube@4.0.6-p1
1
url pkg:composer/ec-cube/ec-cube@4.1.2-p1
purl pkg:composer/ec-cube/ec-cube@4.1.2-p1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/ec-cube/ec-cube@4.1.2-p1
2
url pkg:composer/ec-cube/ec-cube@4.2.3
purl pkg:composer/ec-cube/ec-cube@4.2.3
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/ec-cube/ec-cube@4.2.3
aliases CVE-2023-46845
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-fuus-wqhf-s3be
1
url VCID-he32-4cf1-akf5
vulnerability_id VCID-he32-4cf1-akf5
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting vulnerability in Contents Management of EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0), EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p5), and EC-CUBE 2 series (EC-CUBE 2.11.0 to 2.11.5, EC-CUBE 2.12.0 to 2.12.6, EC-CUBE 2.13.0 to 2.13.5, and EC-CUBE 2.17.0 to 2.17.2) allows a remote authenticated attacker to inject an arbitrary script.
references
0
reference_url https://jvn.jp/en/jp/JVN04785663/
reference_id
reference_type
scores
url https://jvn.jp/en/jp/JVN04785663/
1
reference_url https://www.ec-cube.net/info/weakness/20230214/
reference_id
reference_type
scores
url https://www.ec-cube.net/info/weakness/20230214/
2
reference_url https://www.ec-cube.net/info/weakness/20230214/index_2.php
reference_id
reference_type
scores
url https://www.ec-cube.net/info/weakness/20230214/index_2.php
3
reference_url https://www.ec-cube.net/info/weakness/20230214/index_3.php
reference_id
reference_type
scores
url https://www.ec-cube.net/info/weakness/20230214/index_3.php
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-22438
reference_id CVE-2023-22438
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-22438
fixed_packages
0
url pkg:composer/ec-cube/ec-cube@4.0.6-p1
purl pkg:composer/ec-cube/ec-cube@4.0.6-p1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/ec-cube/ec-cube@4.0.6-p1
1
url pkg:composer/ec-cube/ec-cube@4.1.2-p1
purl pkg:composer/ec-cube/ec-cube@4.1.2-p1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/ec-cube/ec-cube@4.1.2-p1
2
url pkg:composer/ec-cube/ec-cube@4.2.1
purl pkg:composer/ec-cube/ec-cube@4.2.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/ec-cube/ec-cube@4.2.1
aliases CVE-2023-22438
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-he32-4cf1-akf5
Fixing_vulnerabilities
0
url VCID-mr5c-68tz-nfbn
vulnerability_id VCID-mr5c-68tz-nfbn
summary 
Missing Authorization
EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE users.
references
0
reference_url https://jvn.jp/en/jp/JVN53871926/index.html
reference_id
reference_type
scores
url https://jvn.jp/en/jp/JVN53871926/index.html
1
reference_url https://www.ec-cube.net/info/weakness/20220221/
reference_id
reference_type
scores
url https://www.ec-cube.net/info/weakness/20220221/
2
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-25355
reference_id CVE-2022-25355
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2022-25355
fixed_packages
0
url pkg:composer/ec-cube/ec-cube@3.0.18
purl pkg:composer/ec-cube/ec-cube@3.0.18
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fuus-wqhf-s3be
1
vulnerability VCID-he32-4cf1-akf5
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/ec-cube/ec-cube@3.0.18
1
url pkg:composer/ec-cube/ec-cube@4.1.2
purl pkg:composer/ec-cube/ec-cube@4.1.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-f13c-wzhp-cqap
1
vulnerability VCID-fuus-wqhf-s3be
2
vulnerability VCID-he32-4cf1-akf5
3
vulnerability VCID-kgjm-uhbj-gffx
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/ec-cube/ec-cube@4.1.2
aliases CVE-2022-25355
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-mr5c-68tz-nfbn
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:composer/ec-cube/ec-cube@3.0.18