{"id":"CVE-2021-20841","details":"Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings via unspecified vectors.","aliases":["GHSA-jc55-crg7-pr35"],"modified":"2026-03-14T01:43:55.099378Z","published":"2021-11-24T16:15:13.107Z","references":[{"type":"ADVISORY","url":"https://jvn.jp/en/jp/JVN75444925/index.html"},{"type":"FIX","url":"https://www.ec-cube.net/info/weakness/20211111/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ec-cube/ec-cube2","events":[{"introduced":"61e22aa81851ab6b8294367385169d1bb5fb8890"},{"last_affected":"5b82f42d471cdf3dace7522d58e20915320e6614"}],"database_specific":{"versions":[{"introduced":"2.11.2"},{"last_affected":"2.17.1"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-20841.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}]}