CVE-2022-37346

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary files other than image files. If a user with an administrative privilege of EC-CUBE where the vulnerable plugin is installed is led to upload a specially crafted file, an arbitrary script may be executed on the system.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
EC-CUBE CO.,LTD.Product Image Bulk Upload Plugin1.0.0 and 4.1.0

References

Timeline

Published
Sep 27, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-373475.5Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow aCVE-2022-373485.5Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow aCVE-2022-373497.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is reCVE-2022-37359.8A vulnerability was found in seccome Ehoney. It has been rated as critical. This issue affects some unknown processing of the file /api/publCVE-2022-373507.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is reCVE-2022-373515.5This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interactiCVE-2022-373525.5This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interactiCVE-2022-373535.5This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interactiCVE-2022-373547.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is reCVE-2022-373557.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is reCVE-2022-373567.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is reCVE-2022-373577.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is re
CVE-2022-37346: Critical severity, CVSS 9.8 | Vulnix