{"api_version":"1","generated_at":"2026-07-24T01:58:03+00:00","cve":"CVE-2021-20735","urls":{"html":"https://cve.report/CVE-2021-20735","api":"https://cve.report/api/cve/CVE-2021-20735.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-20735","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-20735"},"summary":{"title":"CVE-2021-20735","description":"Cross-site scripting vulnerability in ETUNA EC-CUBE plugins (Delivery slip number plugin (3.0 series) 1.0.10 and earlier, Delivery slip number csv bulk registration plugin (3.0 series) 1.0.8 and earlier, and Delivery slip number mail plugin (3.0 series) 1.0.8 and earlier) allows remote attackers to inject an arbitrary script by executing a specific operation on the management page of EC-CUBE.","state":"PUBLIC","assigner":"vultures@jpcert.or.jp","published_at":"2021-06-22 02:15:00","updated_at":"2021-07-01 18:22:00"},"problem_types":["CWE-79"],"metrics":[],"references":[{"url":"https://jvn.jp/en/jp/JVN79254445/index.html","name":"https://jvn.jp/en/jp/JVN79254445/index.html","refsource":"MISC","tags":[],"title":"JVN#79254445: Multiple ETUNA EC-CUBE plugins vulnerable to cross-site scripting","mime":"text/xml","httpstatus":"200","archivestatus":"404"},{"url":"https://www.ec-cube.net/release/detail.php?release_id=5089","name":"https://www.ec-cube.net/release/detail.php?release_id=5089","refsource":"MISC","tags":[],"title":"配送伝票番号メールプラグイン(3.0系)における脆弱性発覚と対応のお願い | EC-CUBE","mime":"text/xml","httpstatus":"200","archivestatus":"404"},{"url":"https://www.ec-cube.net/release/detail.php?release_id=5088","name":"https://www.ec-cube.net/release/detail.php?release_id=5088","refsource":"MISC","tags":[],"title":"配送伝票番号プラグイン(3.0系)における脆弱性発覚と対応のお願い | EC-CUBE","mime":"text/xml","httpstatus":"200","archivestatus":"404"},{"url":"https://www.ec-cube.net/release/detail.php?release_id=5087","name":"https://www.ec-cube.net/release/detail.php?release_id=5087","refsource":"MISC","tags":[],"title":"配送伝票番号csv一括登録プラグイン(3.0系)における脆弱性発覚と対応のお願い | EC-CUBE","mime":"text/xml","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-20735","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20735","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"20735","vulnerable":"1","versionEndIncluding":"1.0.10","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ec-cube","cpe5":"delivery_slip_number","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"ec-cube","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"20735","vulnerable":"1","versionEndIncluding":"1.0.8","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ec-cube","cpe5":"delivery_slip_number_csv_bulk_registration","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"ec-cube","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"20735","vulnerable":"1","versionEndIncluding":"1.0.8","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ec-cube","cpe5":"delivery_slip_number_mail","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"ec-cube","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2021-20735","ASSIGNER":"vultures@jpcert.or.jp","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"ETUNA","product":{"product_data":[{"product_name":"ETUNA EC-CUBE plugins","version":{"version_data":[{"version_value":"Delivery slip number plugin (3.0 series) 1.0.10 and earlier, Delivery slip number csv bulk registration plugin (3.0 series) 1.0.8 and earlier, and Delivery slip number mail plugin (3.0 series) 1.0.8 and earlier"}]}}]}}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Cross-site scripting"}]}]},"references":{"reference_data":[{"url":"https://www.ec-cube.net/release/detail.php?release_id=5088","refsource":"MISC","name":"https://www.ec-cube.net/release/detail.php?release_id=5088"},{"url":"https://www.ec-cube.net/release/detail.php?release_id=5087","refsource":"MISC","name":"https://www.ec-cube.net/release/detail.php?release_id=5087"},{"url":"https://www.ec-cube.net/release/detail.php?release_id=5089","refsource":"MISC","name":"https://www.ec-cube.net/release/detail.php?release_id=5089"},{"url":"https://jvn.jp/en/jp/JVN79254445/index.html","refsource":"MISC","name":"https://jvn.jp/en/jp/JVN79254445/index.html"}]},"description":{"description_data":[{"lang":"eng","value":"Cross-site scripting vulnerability in ETUNA EC-CUBE plugins (Delivery slip number plugin (3.0 series) 1.0.10 and earlier, Delivery slip number csv bulk registration plugin (3.0 series) 1.0.8 and earlier, and Delivery slip number mail plugin (3.0 series) 1.0.8 and earlier) allows remote attackers to inject an arbitrary script by executing a specific operation on the management page of EC-CUBE."}]}},"nvd":{"publishedDate":"2021-06-22 02:15:00","lastModifiedDate":"2021-07-01 18:22:00","problem_types":["CWE-79"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":2.7},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":4.3},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ec-cube:delivery_slip_number_mail:*:*:*:*:*:ec-cube:*:*","versionEndIncluding":"1.0.8","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ec-cube:delivery_slip_number_csv_bulk_registration:*:*:*:*:*:ec-cube:*:*","versionEndIncluding":"1.0.8","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ec-cube:delivery_slip_number:*:*:*:*:*:ec-cube:*:*","versionEndIncluding":"1.0.10","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"20735","Ordinal":"194780","Title":"CVE-2021-20735","CVE":"CVE-2021-20735","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"20735","Ordinal":"1","NoteData":"Cross-site scripting vulnerability in ETUNA EC-CUBE plugins (Delivery slip number plugin (3.0 series) 1.0.10 and earlier, Delivery slip number csv bulk registration plugin (3.0 series) 1.0.8 and earlier, and Delivery slip number mail plugin (3.0 series) 1.0.8 and earlier) allows remote attackers to inject an arbitrary script by executing a specific operation on the management page of EC-CUBE.","Type":"Description","Title":null},{"CveYear":"2021","CveId":"20735","Ordinal":"2","NoteData":"2021-06-21","Type":"Other","Title":"Published"},{"CveYear":"2021","CveId":"20735","Ordinal":"3","NoteData":"2021-06-21","Type":"Other","Title":"Modified"}]}}}