CVE-2023-46845

HIGH

EC-CUBE 3.0.0-3.0.18-p6, 4.0.0-4.0.6-p3, 4.1.0-4.1.2-p2, 4.2.0-4.2.2 - Authenticated RCE via Twig

Title source: llm
STIX 2.1

Description

EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper settings of the template engine Twig included in the product. As a result, arbitrary code may be executed on the server where the product is running by a user with an administrative privilege.

References (4)

Core 4
Core References
Third Party Advisory
https://jvn.jp/en/jp/JVN29195731/

Scores

CVSS v3 7.2
EPSS 0.0158
EPSS Percentile 72.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-94
Status published
Products (4)
ec-cube/ec-cube 3.0.18 p1 (6 CPE variants)
ec-cube/ec-cube 4.0.6 p1 (3 CPE variants)
ec-cube/ec-cube 4.1.2 p1 (2 CPE variants)
ec-cube/ec-cube 3.0.0 - 3.0.18
Published Nov 07, 2023
Tracked Since Feb 18, 2026