← Back

CVE-2022-25355

nvd nist
Published: Feb 24, 2022Modified: Jun 17, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Exploitability: 3.9 / Impact: 1.4
Source: NVD

Description

EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE users.

Affected (6)

Products: Ec Cube: Ec Cube
Ec Cube
1 product
Ec Cube
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Ec Cube
Ec Cube
From 3.0.0 to 3.0.18
Ec Cube
From 4.0.0 to 4.1.1
Ec Cube
Version 3.0.18
Ec Cube
Version 3.0.18 p1
Ec Cube
Version 3.0.18 p2
Ec Cube
Version 3.0.18 p3

Related CWEs

CWE-913
Improper Control of Dynamically-Managed Code Resources
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

References (4)

Source: vultures@jpcert.or.jp
Third Party Advisory
Source: vultures@jpcert.or.jp
MitigationVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
MitigationVendor Advisory

Timeline

No history available yet.