{"action":"Upgrade ec-cube/ec-cube to 4.1.2 or later.","affected":[{"introduced":"3.0.0","last_affected":"3.0.18-p3"},{"fixed":"4.1.2","introduced":"4.0.0"}],"component":"ec-cube/ec-cube","cve_ids":["CVE-2022-25355"],"ecosystem":"Packagist","epss":0.01156,"exploited":false,"fixed_versions":["4.1.2"],"ghsa_id":"GHSA-pw97-6v74-9w3p","id":"tcs_01M5KF6RGM1M7Q1QZ90X0DZCR8","modified_at":"2026-09-10T03:49:12.831283226Z","published_at":"2022-02-25T00:01:02Z","references":["https://osv.dev/vulnerability/GHSA-pw97-6v74-9w3p","https://nvd.nist.gov/vuln/detail/CVE-2022-25355","https://github.com/EC-CUBE/ec-cube","https://jvn.jp/en/jp/JVN53871926/index.html","https://www.ec-cube.net/info/weakness/20220221"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-pw97-6v74-9w3p","url":"https://osv.dev/vulnerability/GHSA-pw97-6v74-9w3p"}],"summary":"EC-CUBE improperly handles HTTP Host header values"}