What is CVE-2024-41924?

CVE-2024-41924 is a high-severity vulnerability in Ec-Cube Co.,ltd. 4 Series, classified under CWE-349. CVSS score: 7.2/10. Published 2024-07-30.

How severe is CVE-2024-41924?

High severity. CVSS v3 base score is 7.2 out of 10.

Vulnerability in Ec-Cube Co.,ltd. 4 Series

CVE-2024-41924

Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series. If this vulnerability is exploited, an attacker who obtained the administrative privilege may install an arbitrary PHP package. If the obsolete versions of PHP packages are installed, the product may be affected by some known vulnerabilities.

EPSS: 0.003 (18.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Ec-cube Co.,ltd. 4 Series — versions 4.0.0 to 4.0.6-p4, 4.1.0 to 4.1.2-p3, and 4.2.0 to 4.2.3

Weakness classification (CWE)

CWE-349

References

Frequently asked questions

What is CVE-2024-41924?: CVE-2024-41924 is a high-severity vulnerability in Ec-Cube Co.,ltd. 4 Series, classified under CWE-349. CVSS score: 7.2/10. Published 2024-07-30.
How severe is CVE-2024-41924?: High severity. CVSS v3 base score is 7.2 out of 10.