CVE-2023-46845

moderate-risk

Published 2023-11-07

EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper settings of the template engine Twig included in the product. As a result, arbitrary code may be executed on the server where the product is running by a user with an administrative privilege.

Do I need to act?

1.2% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.2/10 High

NETWORK / LOW complexity

Affected Products (12)

Ec-Cube

Affected Vendors

Ec-Cube

References (8)

Third Party Advisory https://jvn.jp/en/jp/JVN29195731/

Exploit https://www.ec-cube.net/info/weakness/20231026/index.php

Exploit https://www.ec-cube.net/info/weakness/20231026/index_3.php

Exploit https://www.ec-cube.net/info/weakness/20231026/index_40.php

Third Party Advisory https://jvn.jp/en/jp/JVN29195731/

Exploit https://www.ec-cube.net/info/weakness/20231026/index.php

Exploit https://www.ec-cube.net/info/weakness/20231026/index_3.php

Exploit https://www.ec-cube.net/info/weakness/20231026/index_40.php

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 4/34 · Minimal

Exposure 17/34 · Moderate