CVE-2021-20842
CVE-2021-20842
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Cross-site request forgery (CSRF) vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page.
CVSS 6.5 · Medium · EPSS 0.6% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
ec-cube 2 series
- Versions
- 2.11.0 to 2.17.1: Affected
No fix published
ec-cube/ec-cube Packagist
- Affected ranges
- ECOSYSTEM: ≥ 2.11.0, < 2.17.2
Update to 2.17.2