PT-2015-7024 · Lockon · Ec-Cube

Gen Sato · Published 2015-10-27 · Updated 2015-10-28 · CVE-2015-5665

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions LOCKON EC-CUBE versions 2.11.0 through 2.13.3

Description A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of arbitrary users for requests that write to PHP scripts, related to the doValidToken function.

Recommendations For versions 2.11.0 through 2.13.3, as a temporary workaround, consider disabling the doValidToken function until a patch is available. Restrict access to PHP scripts that can be written to, to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2015-5665

Affected Products

Ec-Cube

References · 5

• http://ec-cube.net/info/weakness/weakness.php?id=63 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5665 · Security Note
• https://ec-cube.net/info/weakness/201510_01 · Vendor Advisory
• http://jvndb.jvn.jp/jvndb/JVNDB-2015-000166 · Vendor Advisory
• http://jvn.jp/en/jp/JVN97278546/index.html · Vendor Advisory