S
tored cross-site scripting vulnerability exists in EC-CUBE Web API Plugin. When there are multiple users using OAuth Management feature and one of them inputs some crafted value on the OAuth Management page, an arbitrary script may be executed on the web browser of the other user who accessed the management page.
References
Configurations
No configuration.
History
21 Nov 2024, 09:32
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://jvn.jp/en/jp/JVN26225832/ - | |
| References | () https://www.ec-cube.net/info/weakness/20240701/web_api_plugin.php - |
06 Nov 2024, 17:35
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
30 Jul 2024, 13:32
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-07-30 09:15
Updated : 2024-11-21 09:32
NVD link : CVE-2024-41141
Mitre link : CVE-2024-41141
CVE.ORG link : CVE-2024-41141
JSON object : View
Products Affected
No product.
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')