CVE-2024-41141

Stored cross-site scripting vulnerability exists in EC-CUBE Web API Plugin. When there are multiple users using OAuth Management feature and one of them inputs some crafted value on the OAuth Management page, an arbitrary script may be executed on the web browser of the other user who accessed the management page.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://jvn.jp/en/jp/JVN26225832/
https://www.ec-cube.net/info/weakness/20240701/web_api_plugin.php
https://jvn.jp/en/jp/JVN26225832/
https://www.ec-cube.net/info/weakness/20240701/web_api_plugin.php

Configurations

No configuration.

History

No history.

Information

Published : 2024-07-30 09:15

Updated : 2026-06-17 07:47

NVD link : CVE-2024-41141

Mitre link : CVE-2024-41141

CVE.ORG link : CVE-2024-41141

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-41141", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-41141", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-30T14:15:00.508449Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "vultures@jpcert.or.jp", "affectedData": [{"vendor": "EC-CUBE CO.,LTD.", "product": "EC-CUBE Web API Plugin", "versions": [{"status": "affected", "version": "1.0.0 and 2.1.0 to 2.1.3 (for EC-CUBE 4.0/4.1 series)"}]}, {"vendor": "EC-CUBE CO.,LTD.", "product": "EC-CUBE Web API Plugin (4.2 series)", "versions": [{"status": "affected", "version": "4.2.0 to 4.2.3 (for EC-CUBE 4.2 series)"}]}]}], "published": "2024-07-30T09:15:04.070", "references": [{"url": "https://jvn.jp/en/jp/JVN26225832/", "source": "vultures@jpcert.or.jp"}, {"url": "https://www.ec-cube.net/info/weakness/20240701/web_api_plugin.php", "source": "vultures@jpcert.or.jp"}, {"url": "https://jvn.jp/en/jp/JVN26225832/", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.ec-cube.net/info/weakness/20240701/web_api_plugin.php", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Stored cross-site scripting vulnerability exists in EC-CUBE Web API Plugin. When there are multiple users using OAuth Management feature and one of them inputs some crafted value on the OAuth Management page, an arbitrary script may be executed on the web browser of the other user who accessed the management page."}, {"lang": "es", "value": " Existe una vulnerabilidad de cross-site scripting almacenado en EC-CUBE Web API Plugin. Cuando hay varios usuarios que utilizan la funci\u00f3n de administraci\u00f3n de OAuth y uno de ellos ingresa alg\u00fan valor dise\u00f1ado en la p\u00e1gina de administraci\u00f3n de OAuth, se puede ejecutar un script arbitrario en el navegador web del otro usuario que accedi\u00f3 a la p\u00e1gina de administraci\u00f3n."}], "lastModified": "2026-06-17T07:47:21.450", "sourceIdentifier": "vultures@jpcert.or.jp"}