{"id":"CVE-2021-20842","details":"Cross-site request forgery (CSRF) vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page.","aliases":["GHSA-m9hv-qmqh-33qh"],"modified":"2026-07-09T00:05:50.084918Z","published":"2021-11-24T16:15:13.157Z","references":[{"type":"ADVISORY","url":"https://jvn.jp/en/jp/JVN75444925/index.html"},{"type":"FIX","url":"https://www.ec-cube.net/info/weakness/20211111/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ec-cube/ec-cube2","events":[{"introduced":"1004363cf13cc929c0e077c0ac849a6d3c8c10bb"},{"last_affected":"5b82f42d471cdf3dace7522d58e20915320e6614"}],"database_specific":{"cpe":"cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.11.0"},{"last_affected":"2.17.1"}],"source":"CPE_RANGE"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-20842.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"}]}