jvndb - jvndb-2023-000094

jvndb-2023-000094

Vulnerability from jvndb

Published

2023-09-22 13:51

Modified

2024-07-11 16:49

Severity ?

5.4 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Summary

Multiple vulnerabilities in WordPress plugin "Welcart e-Commerce"

Details

WordPress plugin "Welcart e-Commerce" provided by Collne Inc. contains multiple vulnerabilities listed below. * Unrestricted Upload of File with Dangerous Type (CWE-434) - CVE-2023-40219 * Path Traversal (CWE-22) - CVE-2023-40532 * Cross-site Scripting in registration process of Item List page (CWE-79) - CVE-2023-41233 * Cross-site Scripting in Credit Card Payment Setup page (CWE-79) - CVE-2023-41962 * Cross-site Scripting in Item List page (CWE-79) - CVE-2023-43484 * SQL Injection in Item List page (CWE-89) - CVE-2023-43493 * SQL Injection in Order Data Edit page (CWE-89) - CVE-2023-43610 * Cross-site Scripting in Order Data Edit page (CWE-79) - CVE-2023-43614 CVE-2023-40219 Akihiro Hashimoto reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2023-40532, CVE-2023-41233, CVE-2023-41962, CVE-2023-43484, CVE-2023-43493, CVE-2023-43610, CVE-2023-43614 Shogo Kumamaru of LAC CyberLink Co., Ltd. reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

▼	Type	URL
	JVN	https://jvn.jp/en/jp/JVN97197972/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-40219
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-40532
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-41233
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-41962
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-43484
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-43493
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-43610
	CVE	https://www.cve.org/CVERecord?id=CVE-2023-43614
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-40219
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-40532
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-41233
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-41962
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-43484
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-43493
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-43610
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-43614
	Path Traversal(CWE-22)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	SQL Injection(CWE-89)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

▼	Vendor	Product
	Collne Inc.	Welcart e-Commerce

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000094.html",
  "dc:date": "2024-07-11T16:49+09:00",
  "dcterms:issued": "2023-09-22T13:51+09:00",
  "dcterms:modified": "2024-07-11T16:49+09:00",
  "description": "WordPress plugin \"Welcart e-Commerce\" provided by Collne Inc. contains multiple vulnerabilities listed below.\r\n\r\n  * Unrestricted Upload of File with Dangerous Type (CWE-434) - CVE-2023-40219\r\n  * Path Traversal (CWE-22) - CVE-2023-40532\r\n  * Cross-site Scripting in registration process of Item List page (CWE-79) - CVE-2023-41233\r\n  * Cross-site Scripting in Credit Card Payment Setup page (CWE-79) - CVE-2023-41962\r\n  * Cross-site Scripting in Item List page (CWE-79) - CVE-2023-43484\r\n  * SQL Injection in Item List page (CWE-89) - CVE-2023-43493\r\n  * SQL Injection in Order Data Edit page (CWE-89) - CVE-2023-43610\r\n  * Cross-site Scripting in Order Data Edit page (CWE-79) - CVE-2023-43614\r\n\r\nCVE-2023-40219\r\nAkihiro Hashimoto reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\n\r\nCVE-2023-40532, CVE-2023-41233, CVE-2023-41962, CVE-2023-43484, CVE-2023-43493, CVE-2023-43610, CVE-2023-43614\r\nShogo Kumamaru of LAC CyberLink Co., Ltd. reported these vulnerabilities to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000094.html",
  "sec:cpe": {
    "#text": "cpe:/a:collne:welcart_e-commerce",
    "@product": "Welcart e-Commerce",
    "@vendor": "Collne Inc.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "5.5",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "5.4",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2023-000094",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN97197972/index.html",
      "@id": "JVN#97197972",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-40219",
      "@id": "CVE-2023-40219",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-40532",
      "@id": "CVE-2023-40532",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-41233",
      "@id": "CVE-2023-41233",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-41962",
      "@id": "CVE-2023-41962",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-43484",
      "@id": "CVE-2023-43484",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-43493",
      "@id": "CVE-2023-43493",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-43610",
      "@id": "CVE-2023-43610",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-43614",
      "@id": "CVE-2023-43614",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-40219",
      "@id": "CVE-2023-40219",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-40532",
      "@id": "CVE-2023-40532",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-41233",
      "@id": "CVE-2023-41233",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-41962",
      "@id": "CVE-2023-41962",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-43484",
      "@id": "CVE-2023-43484",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-43493",
      "@id": "CVE-2023-43493",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-43610",
      "@id": "CVE-2023-43610",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-43614",
      "@id": "CVE-2023-43614",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-89",
      "@title": "SQL Injection(CWE-89)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Multiple vulnerabilities in WordPress plugin \"Welcart e-Commerce\""
}

cve-2023-43484

Vulnerability from cvelistv5

Published

2023-09-26 08:17

Modified

2024-09-24 14:49

Severity ?

Summary

Cross-site scripting vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script.

References

▼	URL	Tags
	https://www.welcart.com/archives/20106.html
	https://jvn.jp/en/jp/JVN97197972/

Impacted products

▼	Vendor	Product
	Collne Inc.	Welcart e-Commerce

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:44:42.930Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.welcart.com/archives/20106.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN97197972/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-43484",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T14:28:56.038822Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T14:49:50.709Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Welcart e-Commerce",
          "vendor": "Collne Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "versions 2.7 to 2.8.21"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-26T08:17:31.412Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.welcart.com/archives/20106.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN97197972/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-43484",
    "datePublished": "2023-09-26T08:17:31.412Z",
    "dateReserved": "2023-09-20T04:37:55.810Z",
    "dateUpdated": "2024-09-24T14:49:50.709Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2023-43493

Vulnerability from cvelistv5

Published

2023-09-26 08:18

Modified

2024-09-24 14:49

Severity ?

Summary

SQL injection vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with author or higher privilege to obtain sensitive information.

References

▼	URL	Tags
	https://www.welcart.com/archives/20106.html
	https://jvn.jp/en/jp/JVN97197972/

Impacted products

▼	Vendor	Product
	Collne Inc.	Welcart e-Commerce

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:44:42.747Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.welcart.com/archives/20106.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN97197972/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-43493",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T14:28:54.599188Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T14:49:43.414Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Welcart e-Commerce",
          "vendor": "Collne Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "versions 2.7 to 2.8.21"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SQL injection vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with author or higher privilege to obtain sensitive information."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "SQL Injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-26T08:18:24.886Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.welcart.com/archives/20106.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN97197972/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-43493",
    "datePublished": "2023-09-26T08:18:24.886Z",
    "dateReserved": "2023-09-20T04:37:59.324Z",
    "dateUpdated": "2024-09-24T14:49:43.414Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2023-41233

Vulnerability from cvelistv5

Published

2023-09-26 08:15

Modified

2024-09-24 14:50

Severity ?

Summary

Cross-site scripting vulnerability in Item List page registration process of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script.

References

▼	URL	Tags
	https://www.welcart.com/archives/20106.html
	https://jvn.jp/en/jp/JVN97197972/

Impacted products

▼	Vendor	Product
	Collne Inc.	Welcart e-Commerce

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:54:04.507Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.welcart.com/archives/20106.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN97197972/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-41233",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T14:28:58.368791Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T14:50:10.911Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Welcart e-Commerce",
          "vendor": "Collne Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "versions 2.7 to 2.8.21"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability in Item List page registration process of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-26T08:15:39.579Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.welcart.com/archives/20106.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN97197972/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-41233",
    "datePublished": "2023-09-26T08:15:39.579Z",
    "dateReserved": "2023-09-20T04:37:54.930Z",
    "dateUpdated": "2024-09-24T14:50:10.911Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2023-40219

Vulnerability from cvelistv5

Published

2023-09-26 08:13

Modified

2024-09-24 14:33

Severity ?

Summary

Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor or higher privilege to upload an arbitrary file to an unauthorized directory.

References

▼	URL	Tags
	https://www.welcart.com/archives/20106.html
	https://jvn.jp/en/jp/JVN97197972/

Impacted products

▼	Vendor	Product
	Collne Inc.	Welcart e-Commerce

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:24:55.952Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.welcart.com/archives/20106.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN97197972/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:coline:welcart_e-commerce:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "welcart_e-commerce",
            "vendor": "coline",
            "versions": [
              {
                "lessThanOrEqual": "2.8.21",
                "status": "affected",
                "version": "2.7",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-40219",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T14:29:50.904318Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T14:33:19.982Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Welcart e-Commerce",
          "vendor": "Collne Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "versions 2.7 to 2.8.21"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor or higher privilege to upload an arbitrary file to an unauthorized directory."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-26T08:13:16.447Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.welcart.com/archives/20106.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN97197972/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-40219",
    "datePublished": "2023-09-26T08:13:16.447Z",
    "dateReserved": "2023-09-20T04:37:56.787Z",
    "dateUpdated": "2024-09-24T14:33:19.982Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2023-40532

Vulnerability from cvelistv5

Published

2023-09-26 08:14

Modified

2024-09-24 14:50

Severity ?

Summary

Path traversal vulnerability in Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with author or higher privilege to obtain partial information of the files on the web server.

References

▼	URL	Tags
	https://www.welcart.com/archives/20106.html
	https://jvn.jp/en/jp/JVN97197972/

Impacted products

▼	Vendor	Product
	Collne Inc.	Welcart e-Commerce

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:38:50.341Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.welcart.com/archives/20106.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN97197972/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-40532",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T14:28:59.419611Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T14:50:19.887Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Welcart e-Commerce",
          "vendor": "Collne Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "versions 2.7 to 2.8.21"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Path traversal vulnerability in Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with author or higher privilege to obtain partial information of the files on the web server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Path traversal",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-26T08:14:17.836Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.welcart.com/archives/20106.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN97197972/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-40532",
    "datePublished": "2023-09-26T08:14:17.836Z",
    "dateReserved": "2023-09-20T04:37:57.608Z",
    "dateUpdated": "2024-09-24T14:50:19.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2023-43614

Vulnerability from cvelistv5

Published

2023-09-26 08:19

Modified

2024-09-24 14:49

Severity ?

Summary

Cross-site scripting vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script.

References

▼	URL	Tags
	https://www.welcart.com/archives/20106.html
	https://jvn.jp/en/jp/JVN97197972/

Impacted products

▼	Vendor	Product
	Collne Inc.	Welcart e-Commerce

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:44:43.669Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.welcart.com/archives/20106.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN97197972/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-43614",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T14:28:53.358583Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T14:49:33.403Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Welcart e-Commerce",
          "vendor": "Collne Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "versions 2.7 to 2.8.21"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-26T08:19:56.004Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.welcart.com/archives/20106.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN97197972/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-43614",
    "datePublished": "2023-09-26T08:19:56.004Z",
    "dateReserved": "2023-09-20T04:38:01.190Z",
    "dateUpdated": "2024-09-24T14:49:33.403Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2023-41962

Vulnerability from cvelistv5

Published

2023-09-26 08:16

Modified

2024-09-24 14:49

Severity ?

Summary

Cross-site scripting vulnerability in Credit Card Payment Setup page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script in the page.

References

▼	URL	Tags
	https://www.welcart.com/archives/20106.html
	https://jvn.jp/en/jp/JVN97197972/

Impacted products

▼	Vendor	Product
	Collne Inc.	Welcart e-Commerce

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:09:49.462Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.welcart.com/archives/20106.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN97197972/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-41962",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T14:28:57.282604Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T14:49:58.520Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Welcart e-Commerce",
          "vendor": "Collne Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "versions 2.7 to 2.8.21"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability in Credit Card Payment Setup page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script in the page."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-26T08:16:35.700Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.welcart.com/archives/20106.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN97197972/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-41962",
    "datePublished": "2023-09-26T08:16:35.700Z",
    "dateReserved": "2023-09-20T04:38:00.369Z",
    "dateUpdated": "2024-09-24T14:49:58.520Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2023-43610

Vulnerability from cvelistv5

Published

2023-09-26 08:19

Modified

2024-09-24 14:28

Severity ?

Summary

SQL injection vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor (without setting authority) or higher privilege to perform unintended database operations.

References

▼	URL	Tags
	https://www.welcart.com/archives/20106.html
	https://jvn.jp/en/jp/JVN97197972/

Impacted products

▼	Vendor	Product
	Collne Inc.	Welcart e-Commerce

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:44:43.847Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.welcart.com/archives/20106.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN97197972/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-43610",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T14:28:06.299822Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T14:28:26.043Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Welcart e-Commerce",
          "vendor": "Collne Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "versions 2.7 to 2.8.21"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SQL injection vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor (without setting authority) or higher privilege to perform unintended database operations."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "SQL Injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-26T08:19:11.405Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.welcart.com/archives/20106.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN97197972/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-43610",
    "datePublished": "2023-09-26T08:19:11.405Z",
    "dateReserved": "2023-09-20T04:37:58.491Z",
    "dateUpdated": "2024-09-24T14:28:26.043Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from jvndb

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature