CVE-2023-46845

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-46845

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-46845.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-46845

Published

2023-11-07T07:39:57.896Z

Modified

2026-08-12T03:51:16.915015153Z

Summary

[none]

Details

EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper settings of the template engine Twig included in the product. As a result, arbitrary code may be executed on the server where the product is running by a user with an administrative privilege.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46845.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "4.0.0 to 4.0.6-p3"
                },
                {
                    "last_affected": "4.0.0 to 4.0.6-p3"
                },
                {
                    "introduced": " 4.1.0 to 4.1.2-p2"
                },
                {
                    "last_affected": " 4.1.0 to 4.1.2-p2"
                },
                {
                    "introduced": " and 4.2.0 to 4.2.2"
                },
                {
                    "last_affected": " and 4.2.0 to 4.2.2"
                },
                {
                    "introduced": "3.0.0 to 3.0.18-p6"
                },
                {
                    "last_affected": "3.0.0 to 3.0.18-p6"
                }
            ]
        }
    ],
    "cna_assigner": "jpcert"
}

References

Affected packages

Git / github.com/ec-cube/ec-cube

Affected ranges

Type

GIT

Repo

https://github.com/ec-cube/ec-cube

Events

Introduced

4ef1c4f8d51fd9d54a704300a26c65a278dc697a

Last affected

525aaa9f44407903f5cc20b371a5dd199ddae549

Introduced

00ef39551273847cff9b737f98f120a50d4320cc

Last affected

c6838851eade4903e90a0d4294f8342f2178e067

Introduced

5d02dde61f824fb9e264d003f59afc4663811567

Last affected

710b64ce96786770fe59ba8255ff16925171f172

Introduced

0fbb7b3a340c75f2860123d5e01d706f8a15127b

Fixed

daed16e5da3c6847b232af24b06d76d55d8cbd42

Introduced

8d81525bfe50caf159d9a4fb31124f479c6b658e

Last affected

5fa190d57929b2c1cee7b400c45751bed66cc56e

Database specific

Show details

{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:ec-cube:ec-cube:4.0.6:p1:*:*:*:*:*:*",
        "cpe:2.3:a:ec-cube:ec-cube:4.0.6:p2:*:*:*:*:*:*",
        "cpe:2.3:a:ec-cube:ec-cube:4.0.6:p3:*:*:*:*:*:*",
        "cpe:2.3:a:ec-cube:ec-cube:4.1.2:p1:*:*:*:*:*:*",
        "cpe:2.3:a:ec-cube:ec-cube:4.1.2:p2:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "last_affected": "3.0.18"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "last_affected": "4.0.6"
        },
        {
            "introduced": "4.1.0"
        },
        {
            "last_affected": "4.1.2"
        },
        {
            "introduced": "4.2.0"
        },
        {
            "fixed": "4.2.3"
        },
        {
            "introduced": "4.0.6-p1"
        },
        {
            "last_affected": "4.0.6-p1"
        },
        {
            "introduced": "4.0.6-p2"
        },
        {
            "last_affected": "4.0.6-p2"
        },
        {
            "introduced": "4.0.6-p3"
        },
        {
            "last_affected": "4.0.6-p3"
        },
        {
            "introduced": "4.1.2-p1"
        },
        {
            "last_affected": "4.1.2-p1"
        },
        {
            "introduced": "4.1.2-p2"
        },
        {
            "last_affected": "4.1.2-p2"
        }
    ]
}

Affected versions

3.*

3.0.0

3.0.1

3.0.10

3.0.11

3.0.11-RC

3.0.11-pre

3.0.12

3.0.12-p1

3.0.13

3.0.14

3.0.15

3.0.16

3.0.17

3.0.18

3.0.2

3.0.3

3.0.5

3.0.6

3.0.7

3.0.8

3.0.9

4.*

4.0.0

4.0.1

4.0.2

4.0.3

4.0.4

4.0.5

4.0.5-p1

4.0.5-rc

4.0.6

4.0.6-p1

4.0.6-p2

4.0.6-p3

4.1.0

4.1.1

4.1.1-20211130

4.1.2

4.1.2-20220128

4.1.2-20220203

4.1.2-p1

4.1.2-p2

4.2.0

4.2.1

4.2.1-20230116

4.2.2

4.2.2-20230606

4.2.2-20230616

4.2.3-20231002

4.2.3-20231023

Other

co/20190306

co/20190313

co/20190404

co/20190417

co/20190508

co/20190613

co/20190710

co/20190718

co/20190808

co/20190822

co/20190829

co/20190905

co/20190912

co/20190930

co/20191017

co/20191031

co/20191114

co/20191128

co/20191212

co/4.*

co/4.1-20211111

co/4.1-20211118

co/4.1-20211125

co/4.1-20211202

co/4.1-20220210

co/4.1-20220217

co/4.2-20221006

co/4.2-20221013

co/4.2-20221020

co/4.2-20221027

co/4.2-20221215

co/4.2-20230119

co/4.2-20230216

co/4.2-20230222

co/4.2-20230511

co/4.2-20230608

co/4.2-20230921

co/4.2-20231005

co/4.2-20231026

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-46845.json"

Git / github.com/ec-cube/ec-cube3

Affected ranges

Type

GIT

Repo

https://github.com/ec-cube/ec-cube3

Events

Introduced

4ef1c4f8d51fd9d54a704300a26c65a278dc697a

Last affected

525aaa9f44407903f5cc20b371a5dd199ddae549

Introduced

14cd0cf79cec92be106bccb26eb3b84146b75876

Last affected

4b33ec8e658b675fa0fcf819b68c88e3cc102304

Database specific

Show details

{
    "cpe": [
        "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:ec-cube:ec-cube:3.0.18:p1:*:*:*:*:*:*",
        "cpe:2.3:a:ec-cube:ec-cube:3.0.18:p2:*:*:*:*:*:*",
        "cpe:2.3:a:ec-cube:ec-cube:3.0.18:p3:*:*:*:*:*:*",
        "cpe:2.3:a:ec-cube:ec-cube:3.0.18:p4:*:*:*:*:*:*",
        "cpe:2.3:a:ec-cube:ec-cube:3.0.18:p5:*:*:*:*:*:*",
        "cpe:2.3:a:ec-cube:ec-cube:3.0.18:p6:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "last_affected": "3.0.18"
        },
        {
            "introduced": "3.0.18-p1"
        },
        {
            "last_affected": "3.0.18-p1"
        },
        {
            "introduced": "3.0.18-p2"
        },
        {
            "last_affected": "3.0.18-p2"
        },
        {
            "introduced": "3.0.18-p3"
        },
        {
            "last_affected": "3.0.18-p3"
        },
        {
            "introduced": "3.0.18-p4"
        },
        {
            "last_affected": "3.0.18-p4"
        },
        {
            "introduced": "3.0.18-p5"
        },
        {
            "last_affected": "3.0.18-p5"
        },
        {
            "introduced": "3.0.18-p6"
        },
        {
            "last_affected": "3.0.18-p6"
        }
    ]
}

Affected versions

3.*

3.0.0

3.0.1

3.0.10

3.0.11

3.0.11-RC

3.0.11-pre

3.0.12

3.0.12-p1

3.0.13

3.0.14

3.0.15

3.0.16

3.0.17

3.0.18

3.0.18-p1

3.0.18-p2

3.0.18-p3

3.0.18-p4

3.0.18-p5

3.0.18-p6

3.0.2

3.0.3

3.0.5

3.0.6

3.0.7

3.0.8

3.0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-46845.json"