by Kastro
Paper/Archive/CVE-2022-37346

CVE-2022-37346

EC-CUBE CO.,LTD. Product Image Bulk Upload Plugin — EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files.

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 67.8.678 × 2013.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary files other than image files. If a user with an administrative privilege of EC-CUBE where the vulnerable plugin is installed is led to upload a specially crafted file, an arbitrary script may be executed on the system.

Affected

ProductAffectedFixed inSource
Product Image Bulk Upload Plugin1.0.0 and 4.1.0–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refec-cube.net/info/weakness/20220909/product_images_uploader.phprefjvn.jp/en/jp/JVN30900552/index.html