PT-2017-15204 · Cs Cart · Cs-Cart Japanese Edition+1

廣田一貴 · Published 2017-04-28 · Updated 2019-10-03 · CVE-2017-2139

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions CS-Cart Japanese Edition versions 4.3.10 and earlier (excluding v2 and v3) CS-Cart Multivendor Japanese Edition versions 4.3.10 and earlier (excluding v2 and v3)

Description The issue allows remote attackers to bypass access restrictions and obtain customer information. This is achieved via the orders.pre.php file.

Recommendations For CS-Cart Japanese Edition versions 4.3.10 and earlier (excluding v2 and v3), restrict access to the orders.pre.php file until a fix is available. For CS-Cart Multivendor Japanese Edition versions 4.3.10 and earlier (excluding v2 and v3), restrict access to the orders.pre.php file until a fix is available.

Fix

Weakness Enumeration

CWE-425

Related Identifiers

CVE-2017-2139

Affected Products

Cs-Cart Japanese Edition

Cs-Cart Multivendor Japanese Edition

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-2139 · Security Note
• https://osv.dev/vulnerability/CVE-2017-2139 · Vendor Advisory
• http://tips.cs-cart.jp/fix-jvn-14396697.html · Vendor Advisory
• http://jvn.jp/en/jp/JVN14396697/index.html · Note