Vulnerability Description
Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and earlier, and GMO-PG Payment Module (PG Multi-Payment Service) (2.11) version 2.3.17 and earlier) allow an attacker with administrator rights to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ec-Cube | Ec-Cube Payment Module | <= 2.3.17 |
| Gmo-Pg | Gmo-Pg Payment Module | <= 2.3.17 |
| Ec-Cube | Ec-Cube | 2.11 |
Related Weaknesses (CWE)
References
- http://jvn.jp/en/jp/JVN06372244/index.htmlThird Party Advisory
- http://jvn.jp/en/jp/JVN06372244/index.htmlThird Party Advisory
FAQ
What is CVE-2018-0657?
CVE-2018-0657 is a vulnerability with a CVSS score of 4.8 (MEDIUM). Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment...
How severe is CVE-2018-0657?
CVE-2018-0657 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-0657?
Check the references section above for vendor advisories and patch information. Affected products include: Ec-Cube Ec-Cube Payment Module, Gmo-Pg Gmo-Pg Payment Module, Ec-Cube Ec-Cube.