CVE-2018-0657

Name of the Vulnerable Software and Affected Versions EC-CUBE Payment Module versions 3.5.23 and earlier EC-CUBE Payment Module (2.11) version 2.3.17 and earlier GMO-PG Payment Module (PG Multi-Payment Service) versions 3.5.23 and earlier GMO-PG Payment Module (PG Multi-Payment Service) (2.11) version 2.3.17 and earlier

Description A cross-site scripting issue exists, allowing an attacker with administrator rights to inject arbitrary web script or HTML via unspecified vectors.

Recommendations For EC-CUBE Payment Module versions 3.5.23 and earlier, update to a version later than 3.5.23. For EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, update to a version later than 2.3.17. For GMO-PG Payment Module (PG Multi-Payment Service) versions 3.5.23 and earlier, update to a version later than 3.5.23. For GMO-PG Payment Module (PG Multi-Payment Service) (2.11) version 2.3.17 and earlier, update to a version later than 2.3.17.