Vulnerability · Published Feb 24, 2022 · Assigned by jpcert

CVE-2022-21179

Medium 4.3

In plain English

A medium-severity security flaw in EC-CUBE plugin 'Mail Magazine Management Plugin' from EC-CUBE CO.,LTD.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS NVD)4.3Medium

Exploit odds (30 days)0.5%top 59.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1.0.4 (for EC-CUBE 3 series) allows a remote unauthenticated attacker to hijack the authentication of an administrator via a specially crafted page, and Mail Magazine Templates and/or transmitted history information may be deleted unintendedly.

Affected products (as reported)

Vendor	Product	Versions
EC-CUBE CO.,LTD.	EC-CUBE plugin 'Mail Magazine Management Plugin'	ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1.0.4 (for EC-CUBE 3 series)

References

https://www.ec-cube.net/info/weakness/20220221/mail_magazine_plugin.php x_refsource_MISC
https://jvn.jp/en/jp/JVN67108459/index.html x_refsource_MISC