CVE-2013-3653

Published Jun 30, 2013

Last updated 11 years ago

Overview

Description: Multiple cross-site scripting (XSS) vulnerabilities in the RecommendSearch feature in the management screen in LOCKON EC-CUBE before 2.12.5 allow remote attackers to inject arbitrary web script or HTML via vectors involving the rank parameter, a different vulnerability than CVE-2013-3652.
Source: vultures@jpcert.or.jp
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 4.3
Impact score: 2.9
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:N/I:P/A:N

Weaknesses

nvd@nist.gov: CWE-79

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:lockon:ec-cube:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "93BE8264-1904-4FB8-927C-E8668D899EC3",
            "versionEndIncluding": "2.12.4"
          },
          {
            "criteria": "cpe:2.3:a:lockon:ec-cube:2.12.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2D261CC2-F7E5-437E-884B-D25C72F939C6"
          },
          {
            "criteria": "cpe:2.3:a:lockon:ec-cube:2.12.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CA1710AF-A87A-4970-BF19-481040A7524A"
          },
          {
            "criteria": "cpe:2.3:a:lockon:ec-cube:2.12.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7C72DED8-1073-47A9-B089-84E3ABC96401"
          },
          {
            "criteria": "cpe:2.3:a:lockon:ec-cube:2.12.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6E3D5763-00DB-4F7E-AA08-1A2AA3070B5D"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References