CVE-2021-20778

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain sensitive information via unspecified vectors.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
EC-CUBE CO.,LTD.	EC-CUBE	4.0.6 (EC-CUBE 4 series)

References

http://jvn.jp/en/jp/JVN57942445/index.htmlThird Party Advisory
https://jvn.jp/en/jp/JVN57942445/index.htmlThird Party Advisory
https://www.ec-cube.net/info/weakness/weakness.php?id=80Patch, Vendor Advisory
http://jvn.jp/en/jp/JVN57942445/index.htmlThird Party Advisory
https://jvn.jp/en/jp/JVN57942445/index.htmlThird Party Advisory
https://www.ec-cube.net/info/weakness/weakness.php?id=80Patch, Vendor Advisory

Timeline

Published: Jul 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-207798.8Cross-site request forgery (CSRF) vulnerability in WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8 allows remote at CVE-2021-20788.2Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet). Supported versions that are affected are 12 CVE-2021-207808.8Cross-site request forgery (CSRF) vulnerability in WPCS - WordPress Currency Switcher 1.1.6 and earlier allows remote attackers to hijack th CVE-2021-207818.8Cross-site request forgery (CSRF) vulnerability in WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions pri CVE-2021-207828.8Cross-site request forgery (CSRF) vulnerability in Software License Manager versions prior to 4.4.6 allows remote attackers to hijack the au CVE-2021-207838.8Cross-site request forgery (CSRF) vulnerability in Optical BB unit E-WMTA2.3 allows a remote attacker to hijack the authentication of admini CVE-2021-207846.1HTTP header injection vulnerability in Everything version 1.0, 1.1, and 1.2 except the Lite version may allow a remote attacker to inject an CVE-2021-207854.8Cross-site scripting vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession b CVE-2021-207864.3Cross-site request forgery (CSRF) vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, G CVE-2021-207874.8Cross-site scripting vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession b CVE-2021-207884.3Server-side request forgery (SSRF) vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, CVE-2021-207896.1Open redirect vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud