{"id":"GHSA-jc55-crg7-pr35","aliases":["CVE-2021-20841"],"title":"EC-CUBE Improper access control in Management screen","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings via unspecified vectors.","severity":"medium","score":6.5,"published":"2021-11-25T00:00:38.000Z","modified":"2024-04-25T20:57:37.325Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"ec-cube/ec-cube","sources":[{"name":"OSV · GHSA-jc55-crg7-pr35","url":"https://osv.dev/vulnerability/GHSA-jc55-crg7-pr35"}],"ranges":[{"events":[{"introduced":"2.11.2"},{"fixed":"2.17.2"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["2.17.2"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2021-20841","https://github.com/EC-CUBE/ec-cube","https://jvn.jp/en/jp/JVN75444925/index.html","https://www.ec-cube.net/info/weakness/20211111"],"sources":[{"name":"OSV","id":"GHSA-jc55-crg7-pr35","modified":"2024-04-25T20:57:37.325213Z","url":"https://osv.dev/vulnerability/GHSA-jc55-crg7-pr35"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","score":6.5}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T17:10:31.931Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}