CVE-2022-25355

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-02-24 · updated 2026-06-17
Weakness: CWE-913

Description

EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE users.

Affected products

EC-CUBE CO.,LTD. EC-CUBE: from 3.0.0 before 3.0.18; from 4.0.0 through 4.1.1; 3.0.18, 3.0.18-p1, 3.0.18-p2, 3.0.18-p3 — fixed in 3.0.18

How to fix

Upgrade to a fixed version: EC-CUBE CO.,LTD. EC-CUBE 3.0.18. Check the vendor advisory for mitigations.

References

https://jvn.jp/en/jp/JVN53871926/index.html
https://www.ec-cube.net/info/weakness/20220221/
https://jvn.jp/en/jp/JVN53871926/index.html
https://www.ec-cube.net/info/weakness/20220221/

Get alerted when CVE-2022-25355 or the next vulnerability affects your stack