Unrated
Security advisory
EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using the product.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-40281
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 19:45 UTC · Revision 1
Source evidence
EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using the product.
osv:CVE-2023-40281
Complete source record
{
"id": "c3840b4e11ae08154f99ef242fd5f0311594d03e5360cff901ed46898d7cf6e1",
"url": "https://osv.dev/vulnerability/CVE-2023-40281",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2023-40281",
"summary": "EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in \"mail/template\" and \"products/product\" of Management page. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using the product.",
"evidence": "osv:CVE-2023-40281",
"products": [],
"severity": "unknown",
"structured": {
"id": "CVE-2023-40281",
"aliases": [
"CVE-2023-40281"
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/ec-cube/ec-cube",
"type": "GIT",
"events": [
{
"introduced": "1004363cf13cc929c0e077c0ac849a6d3c8c10bb"
},
{
"last_affected": "13dfb352e47c6f231ead5e5b62dc0ec11e354789"
},
{
"introduced": "e2547e2d1775ceacd7c73e1b72d5512efcdb45e7"
},
{
"last_affected": "92fe8f744181641bb8ce0db28b988b089004fbfa"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.11.0"
},
{
"last_affected": "2.11.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.12.0"
},
{
"last_affected": "2.12.6"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-40281.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/ec-cube/ec-cube2",
"type": "GIT",
"events": [
{
"introduced": "1004363cf13cc929c0e077c0ac849a6d3c8c10bb"
},
{
"last_affected": "13dfb352e47c6f231ead5e5b62dc0ec11e354789"
},
{
"introduced": "e2547e2d1775ceacd7c73e1b72d5512efcdb45e7"
},
{
"last_affected": "92fe8f744181641bb8ce0db28b988b089004fbfa"
},
{
"introduced": "9d428d236baa44358f56a38b3ba336222535f7fd"
},
{
"fixed": "25e9c8c90ed17ce6857b78570e403bfa11095941"
},
{
"introduced": "0f4bf44ed1980ed45b18fc4dfa1543f51c57c48e"
},
{
"fixed": "eb43f49065a0e5f6c5367a5d2ae5fd994a5e3bb5"
},
{
"introduced": "25e9c8c90ed17ce6857b78570e403bfa11095941"
},
{
"last_affected": "073dbc8d37086bcb13bc8460cd244ccffa1830ac"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.11.0"
},
{
"last_affected": "2.11.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.12.0"
},
{
"last_affected": "2.12.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.13.0"
},
{
"fixed": "2.13.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.17.0"
},
{
"fixed": "2.17.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:ec-cube:ec-cube:2.13.5:-:*:*:*:*:*:*",
"range": [
{
"introduced": "2.13.5-NA"
},
{
"last_affected": "2.13.5-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:ec-cube:ec-cube:2.13.5:patch1:*:*:*:*:*:*",
"range": [
{
"introduced": "2.13.5-patch1"
},
{
"last_affected": "2.13.5-patch1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:ec-cube:ec-cube:2.17.2:-:*:*:*:*:*:*",
"range": [
{
"introduced": "2.17.2-NA"
},
{
"last_affected": "2.17.2-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:ec-cube:ec-cube:2.17.2:patch1:*:*:*:*:*:*",
"range": [
{
"introduced": "2.17.2-patch1"
},
{
"last_affected": "2.17.2-patch1"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"2.13.5-NA",
"2.13.5-patch1",
"2.17.2-NA",
"2.17.2-patch1",
"eccube2-weekly-20211026",
"eccube2-weekly-20211019",
"eccube2-weekly-20211012",
"eccube2-weekly-20211005",
"eccube2-weekly-20210928",
"eccube2-weekly-20210921",
"eccube2-weekly-20210914",
"eccube2-weekly-20210907",
"eccube2-weekly-20210831",
"eccube2-weekly-20210824",
"eccube2-weekly-20210817",
"eccube2-weekly-20210803",
"eccube2-weekly-20210727",
"eccube2-weekly-20210720",
"eccube2-weekly-20210713",
"eccube2-weekly-20210706",
"eccube2-weekly-20210629",
"eccube2-weekly-20210622",
"eccube2-weekly-20210615",
"eccube2-weekly-20210608",
"eccube2-weekly-20210601",
"eccube2-weekly-20210525",
"eccube2-weekly-20210504",
"eccube2-weekly-20210427",
"eccube2-weekly-20210420",
"eccube2-weekly-20210413",
"eccube2-weekly-20210511",
"eccube2-weekly-20210406",
"eccube2-weekly-20210330",
"eccube2-weekly-20210323",
"eccube2-weekly-20210316",
"eccube2-weekly-20210309",
"eccube2-weekly-20210302",
"eccube2-weekly-20210223",
"eccube2-weekly-20210216",
"eccube2-weekly-20210209",
"eccube2-weekly-20210202",
"eccube2-weekly-20210126",
"eccube2-weekly-20210119",
"eccube2-weekly-20210112",
"eccube2-weekly-20210105",
"eccube2-weekly-20201229",
"eccube2-weekly-20201222",
"eccube2-weekly-20201215",
"eccube2-weekly-20201208",
"eccube2-weekly-20201201",
"eccube2-weekly-20201124",
"eccube2-weekly-20201117",
"eccube2-weekly-20201110",
"eccube-2.17.1",
"eccube-2.17.1-RC",
"eccube-2.17.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-40281.json"
}
}
],
"modified": "2026-10-28T02:30:23.000585385Z",
"provider": "osv",
"references": [
"https://jvn.jp/en/jp/JVN46993816/",
"https://www.ec-cube.net/info/weakness/20230727/",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40281.json",
"https://nvd.nist.gov/vuln/detail/CVE-2023-40281"
],
"provider_metadata": {
"cna_assigner": "jpcert",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "2.11.0 to 2.17.2-p1"
},
{
"last_affected": "2.11.0 to 2.17.2-p1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40281.json"
}
},
"related_cves": [
{
"value": "CVE-2023-40281",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 489344,
"published_at": "2023-08-17T06:37:01.773+00:00"
}