CVE-2013-3654

Published Jun 30, 2013

Last updated 11 years ago

Overview

Description: Directory traversal vulnerability in LOCKON EC-CUBE 2.12.0 through 2.12.4 allows remote attackers to read arbitrary image files via vectors related to data/class/SC_CheckError.php and data/class/SC_FormParam.php, a different vulnerability than CVE-2013-3650.
Source: vultures@jpcert.or.jp
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 5
Impact score: 2.9
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:P/I:N/A:N

Weaknesses

nvd@nist.gov: CWE-22

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:lockon:ec-cube:2.12.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2D261CC2-F7E5-437E-884B-D25C72F939C6"
          },
          {
            "criteria": "cpe:2.3:a:lockon:ec-cube:2.12.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CA1710AF-A87A-4970-BF19-481040A7524A"
          },
          {
            "criteria": "cpe:2.3:a:lockon:ec-cube:2.12.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7C72DED8-1073-47A9-B089-84E3ABC96401"
          },
          {
            "criteria": "cpe:2.3:a:lockon:ec-cube:2.12.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6E3D5763-00DB-4F7E-AA08-1A2AA3070B5D"
          },
          {
            "criteria": "cpe:2.3:a:lockon:ec-cube:2.12.4:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "43325D17-36C5-41DC-B343-2E647A4246AE"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References