CVE-2021-20751: 
PHP vulnerability analysis and mitigation

Cross-site scripting vulnerability (CVE-2021-20751) affects EC-CUBE versions 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series). The vulnerability was discovered in June 2021 and disclosed by JPCERT/CC (JVN Advisory). The affected software is EC-CUBE, an e-commerce platform developed by EC-CUBE CO.,LTD.

The vulnerability is classified as a cross-site scripting (CWE-79) issue. It has been assigned a CVSS v3.1 Base Score of 6.1 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) and a CVSS v2.0 Base Score of 4.3 MEDIUM (Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N) (JVN Advisory).

If successfully exploited, a remote attacker can inject arbitrary scripts by leading an administrator or a user to a specially crafted page and performing specific operations. This could result in the execution of malicious scripts in the administrator's or user's web browser (JVN Advisory).

EC-CUBE has released updates to address this vulnerability. Users are advised to update to the latest version according to the information provided by the developer. Additionally, patches are available for both EC-CUBE 3 and EC-CUBE 4 series (EC-CUBE Advisory, JVN Advisory).