CVE-2024-41924 | Mend Vulnerability Database

Vulnerability DatabaseCVE-2024-41924

CVE-2024-41924

Published:July 30, 2024

Updated:May 27, 2026

Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series. If this vulnerability is exploited, an attacker who obtained the administrative privilege may install an arbitrary PHP package. If the obsolete versions of PHP packages are installed, the product may be affected by some known vulnerabilities.

Affected Packages

ec-cube/ec-cube (PHP):

Affected version(s) =dev-dependabot/npm_and_yarn/zap/selenium/ci/TypeScript/minimist-1.2.6 <eccube-1.3.0-beta

Fix Suggestion:

Update to version eccube-1.3.0-beta

ec-cube/ec-cube (PHP):

Affected version(s) =dev-dependabot/npm_and_yarn/ini-1.3.7 <eccube-1.4.0-beta-dev

Fix Suggestion:

Update to version eccube-1.4.0-beta-dev

ec-cube/ec-cube (PHP):

Affected version(s) =dev-dependabot/npm_and_yarn/zap/selenium/ci/TypeScript/word-wrap-1.2.5 <dev-dependabot/npm_and_yarn/minimist-1.2.6

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/minimist-1.2.6

ec-cube/ec-cube (PHP):

Affected version(s) >=dev-co/4.2 <dev-release/4.2.0

Fix Suggestion:

Update to version dev-release/4.2.0

ec-cube/ec-cube (PHP):

Affected version(s) >=4.3.0-alpha <4.3.0

Fix Suggestion:

Update to version 4.3.0

ec-cube/ec-cube (PHP):

Affected version(s) >=dev-dependabot/composer/vlucas/phpdotenv-5.6.0 <dev-dependabot/npm_and_yarn/terser-5.15.0

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/terser-5.15.0

ec-cube/ec-cube (PHP):

Affected version(s) >=4.1.1 <4.1.2-p4

Fix Suggestion:

Update to version 4.1.2-p4

ec-cube/ec-cube (PHP):

Affected version(s) =dev-dependabot/composer/composer/ca-bundle-1.5.0 <dev-dependabot/composer/composer/ca-bundle-1.5.5

Fix Suggestion:

Update to version dev-dependabot/composer/composer/ca-bundle-1.5.5

ec-cube/ec-cube (PHP):

Affected version(s) >=dev-dependabot/npm_and_yarn/normalize.css-8.0.1 <dev-fix-csv-time-id

Fix Suggestion:

Update to version dev-fix-csv-time-id

ec-cube/ec-cube (PHP):

Affected version(s) =4.1-beta3 <dev-4.1-beta3

Fix Suggestion:

Update to version dev-4.1-beta3

ec-cube/ec-cube (PHP):

Affected version(s) >=dev-dependabot/composer/composer/composer-2.6.4 <eccube-2.11.0-beta

Fix Suggestion:

Update to version eccube-2.11.0-beta

ec-cube/ec-cube (PHP):

Affected version(s) =dev-dependabot/composer/composer/composer-2.1.9 <eccube-2.2.0-beta

Fix Suggestion:

Update to version eccube-2.2.0-beta

ec-cube/ec-cube (PHP):

Affected version(s) >=dev-dependabot/npm_and_yarn/multi-a9f852c250 <dev-dependabot/npm_and_yarn/zap/selenium/ci/TypeScript/tmpl-1.0.5

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/zap/selenium/ci/TypeScript/tmpl-1.0.5

ec-cube/ec-cube (PHP):

Affected version(s) >=dev-dependabot/npm_and_yarn/browserslist-4.16.6 <dev-dependabot/composer/exercise/htmlpurifier-bundle-5.0

Fix Suggestion:

Update to version dev-dependabot/composer/exercise/htmlpurifier-bundle-5.0

ec-cube/ec-cube (PHP):

Affected version(s) >=4.0.3 <4.0.6-p5

Fix Suggestion:

Update to version 4.0.6-p5

ec-cube/ec-cube (PHP):

Affected version(s) >=dev-dependabot/composer/tecnickcom/tcpdf-6.7.4 <dev-dependabot/composer/tecnickcom/tcpdf-6.7.7

Fix Suggestion:

Update to version dev-dependabot/composer/tecnickcom/tcpdf-6.7.7

ec-cube/ec-cube (PHP):

Affected version(s) =4.1.0 <dev-4.1.0-check

Fix Suggestion:

Update to version dev-4.1.0-check

ec-cube/ec-cube (PHP):

Affected version(s) >=dev-dependabot/github_actions/actions/cache-4 <dev-dependabot/npm_and_yarn/multi-82ad408bf4

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/multi-82ad408bf4

ec-cube/ec-cube (PHP):

Affected version(s) =dev-dependabot/npm_and_yarn/zap/selenium/ci/TypeScript/ip-1.1.9 <eccube-1.2.0-beta

Fix Suggestion:

Update to version eccube-1.2.0-beta

ec-cube/ec-cube (PHP):

Affected version(s) =dev-dependabot/composer/twig/twig-2.14.11 <dev-dependabot/composer/twig/twig-2.15.3

Fix Suggestion:

Update to version dev-dependabot/composer/twig/twig-2.15.3

ec-cube/ec-cube (PHP):

Affected version(s) =dev-4.3-symfony6 <dev-co/4.3

Fix Suggestion:

Update to version dev-co/4.3

ec-cube/ec-cube (PHP):

Affected version(s) >=dev-dependabot/composer/symfony/form-6.4.7 <dev-dependabot/composer/symfony/security-bundle-6.4.10

Fix Suggestion:

Update to version dev-dependabot/composer/symfony/security-bundle-6.4.10

ec-cube/ec-cube (PHP):

Affected version(s) =4.0.0 <4.0.x-dev

Fix Suggestion:

Update to version 4.0.x-dev

ec-cube/ec-cube (PHP):

Affected version(s) =dev-dependabot/npm_and_yarn/y18n-3.2.2 <dev-dependabot/composer/symfony/polyfill-php73-1.30.0

Fix Suggestion:

Update to version dev-dependabot/composer/symfony/polyfill-php73-1.30.0

ec-cube/ec-cube (PHP):

Affected version(s) =dev-dependabot/composer/doctrine/instantiator-2.0.0 <version-2

Fix Suggestion:

Update to version version-2

ec-cube/ec-cube (PHP):

Affected version(s) >=dev-dependabot/github_actions/docker/login-action-3 <3.0.1

Fix Suggestion:

Update to version 3.0.1

ec-cube/ec-cube (PHP):

Affected version(s) >=dev-pick-for-4.0 <4.0.2

Fix Suggestion:

Update to version 4.0.2

ec-cube/ec-cube (PHP):

Affected version(s) >=dev-dependabot/composer/nesbot/carbon-3.4.0 <dev-dependabot/composer/doctrine/common-3.4.5

Fix Suggestion:

Update to version dev-dependabot/composer/doctrine/common-3.4.5

ec-cube/ec-cube (PHP):

Affected version(s) =dev-test <dev-update-composer

Fix Suggestion:

Update to version dev-update-composer

ec-cube/ec-cube (PHP):

Affected version(s) =dev-4.0.6-p1 <dev-4.0.6-p2

Fix Suggestion:

Update to version dev-4.0.6-p2

ec-cube/ec-cube (PHP):

Affected version(s) =dev-dependabot/npm_and_yarn/zap/selenium/ci/TypeScript/braces-3.0.3 <3.0.4

Fix Suggestion:

Update to version 3.0.4

ec-cube/ec-cube (PHP):

Affected version(s) =4.3.x-dev <dev-4.3-private

Fix Suggestion:

Update to version dev-4.3-private

ec-cube/ec-cube (PHP):

Affected version(s) =dev-dependabot/npm_and_yarn/webpack-5.76.0 <dev-dependabot/npm_and_yarn/webpack-5.94.0

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/webpack-5.94.0

ec-cube/ec-cube (PHP):

Affected version(s) >=dev-dependabot/github_actions/docker/build-push-action-5 <dev-dependabot/npm_and_yarn/zap/selenium/ci/TypeScript/ansi-regex-5.0.1

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/zap/selenium/ci/TypeScript/ansi-regex-5.0.1

ec-cube/ec-cube (PHP):

Affected version(s) =dev-maintenance/4.0 <dev-maintenance/4.0-private

Fix Suggestion:

Update to version dev-maintenance/4.0-private

ec-cube/ec-cube (PHP):

Affected version(s) >=dev-fix/admin_product_product_class_sort <dev-improve/csv-split

Fix Suggestion:

Update to version dev-improve/csv-split

ec-cube/ec-cube (PHP):

Affected version(s) >=dev-co/4.1 <dev-maintenance/4.1-private

Fix Suggestion:

Update to version dev-maintenance/4.1-private

ec-cube/ec-cube (PHP):

Affected version(s) >=4.2.2 <4.2.3-p1

Fix Suggestion:

Update to version 4.2.3-p1

ec-cube/ec-cube (PHP):

Affected version(s) >=dev-dependabot/composer/guzzlehttp/guzzle-6.5.7 <dev-dependabot/composer/knplabs/knp-paginator-bundle-6.6.1

Fix Suggestion:

Update to version dev-dependabot/composer/knplabs/knp-paginator-bundle-6.6.1

ec-cube/ec-cube (PHP):

Affected version(s) >=4.2.0-beta2-20220916 <4.2.x-dev

Fix Suggestion:

Update to version 4.2.x-dev

ec-cube/ec-cube (PHP):

Affected version(s) >=dev-refine-kenshi/feature/class_csv <dev-revert-5391-issue/5279

Fix Suggestion:

Update to version dev-revert-5391-issue/5279

ec-cube/ec-cube (PHP):

Affected version(s) >=dev-dependabot/npm_and_yarn/sass-1.77.1 <dev-dependabot/npm_and_yarn/sass-1.81.0

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/sass-1.81.0

ec-cube/ec-cube (PHP):

Affected version(s) >=dev-dependabot/npm_and_yarn/axios-and-browser-sync--removed <dev-dependabot/npm_and_yarn/engine.io-and-browser-sync-6.2.0

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/engine.io-and-browser-sync-6.2.0

ec-cube/ec-cube (PHP):

Affected version(s) >=dev-dependabot/composer/sebastian/global-state-5.0.7 <dev-dependabot/composer/nikic/php-parser-5.3.1

Fix Suggestion:

Update to version dev-dependabot/composer/nikic/php-parser-5.3.1

ec-cube/ec-cube (PHP):

Affected version(s) =dev-dependabot/composer/twig/extra-bundle-3.10.0 <dev-dependabot/composer/twig/extra-bundle-3.11.0

Fix Suggestion:

Update to version dev-dependabot/composer/twig/extra-bundle-3.11.0

ec-cube/ec-cube (PHP):

Affected version(s) =dev-dependabot/composer/robthree/twofactorauth-2.1.0 <eccube-2.1.2

Fix Suggestion:

Update to version eccube-2.1.2

ec-cube/ec-cube (PHP):

Affected version(s) =dev-improve/edit-id <dev-modify-e2e/EA07

Fix Suggestion:

Update to version dev-modify-e2e/EA07

ec-cube/ec-cube (PHP):

Affected version(s) >=dev-dependabot/composer/symfony/security-3.4.48 <dev-dependabot/composer/nesbot/carbon-3.8.2

Fix Suggestion:

Update to version dev-dependabot/composer/nesbot/carbon-3.8.2

ec-cube/ec-cube (PHP):

Affected version(s) =dev-dependabot/composer/composer/composer-1.10.22 <dev-dependabot/composer/seld/jsonlint-1.11.0

Fix Suggestion:

Update to version dev-dependabot/composer/seld/jsonlint-1.11.0

ec-cube/ec-cube (PHP):

Affected version(s) >=dev-dependabot/github_actions/docker/build-push-action-6 <dev-dependabot/composer/knplabs/knp-paginator-bundle-6.4.0

Fix Suggestion:

Update to version dev-dependabot/composer/knplabs/knp-paginator-bundle-6.4.0

Related Resources (2)

https://www.ec-cube.net/info/weakness/20240701/index.php

https://jvn.jp/en/jp/JVN48324254/

Do you need more information?

CVSS v4

Base Score:

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

HIGH

User Interaction

NONE

Vulnerable System Confidentiality

HIGH

Vulnerable System Integrity

HIGH

Vulnerable System Availability

HIGH

Subsequent System Confidentiality

NONE

Subsequent System Integrity

NONE

Subsequent System Availability

NONE

CVSS v3

Base Score:

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Weakness Type (CWE)

Acceptance of Extraneous Untrusted Data With Trusted Data

CWE-349

EPSS

Base Score:

0.14