CVE-2024-41141mediumCWE-79

CVE-2024-41141: medium-severity vulnerability in EC-CUBE Web API Plugin

Published · Updated

Follow this CVE+ Monitor EC-CUBE Web API Plugin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 0.3%
Stored cross-site scripting vulnerability exists in EC-CUBE Web API Plugin. When there are multiple users using OAuth Management feature and one of them inputs some crafted value on the OAuth Management page, an arbitrary script may be executed on the web browser of the other user who accessed the management page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
EC-CUBE CO.,LTD. · EC-CUBE Web API PluginEC-CUBE CO.,LTD. · EC-CUBE Web API Plugin (4.2 series)