PT-2015-7024 · Lockon · Ec-Cube

Gen Sato · Publicado 2015-10-27 · Atualizado 2015-10-28 · CVE-2015-5665

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions LOCKON EC-CUBE versions 2.11.0 through 2.13.3

Description A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of arbitrary users for requests that write to PHP scripts, related to the doValidToken function.

Recommendations For versions 2.11.0 through 2.13.3, as a temporary workaround, consider disabling the doValidToken function until a patch is available. Restrict access to PHP scripts that can be written to, to minimize the risk of exploitation.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2015-5665

Produtos afetados

Ec-Cube

Referências · 5

• http://ec-cube.net/info/weakness/weakness.php?id=63 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-5665 · Nota de Segurança
• https://ec-cube.net/info/weakness/201510_01 · Aviso do Fabricante
• http://jvndb.jvn.jp/jvndb/JVNDB-2015-000166 · Aviso do Fabricante
• http://jvn.jp/en/jp/JVN97278546/index.html · Aviso do Fabricante