JVNDB-2009-000078

EC-CUBE information disclosure vulnerability

EC-CUBE from LOCKON CO.,LTD. contains an information disclosure vulnerability.

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an information disclosure vulnerability.

Base Metrics: 5.0 (Medium) [IPA Score]

• Access Vector: Network
• Access Complexity: Low
• Authentication: None
• Confidentiality Impact: Partial
• Integrity Impact: None
• Availability Impact: None

LOCKON CO.,LTD

• EC-CUBE Ver2 Version 2.4.0 RC1 to 2.4.1
• EC-CUBE Community Edition r18068 to r18428

A remote attacker may be able to obtain customer data that is saved by EC-CUBE.

[Update the Software]
Apply the latest updates provided by the vendor.

[Fix the file]
Modify the specific file according to the information provided by the developer.

LOCKON CO.,LTD

• LOCKON CO.,LTD : 2009/12/7 (Japanese)

1. JVN : JVN#79762947
2. National Vulnerability Database (NVD) : CVE-2009-4236
3. Common Vulnerabilities and Exposures (CVE) : CVE-2009-4236
4. Secunia Advisory : SA37603
5. ISS X-Force Database : 54573
6. VUPEN Security : VUPEN/ADV-2009-3421
7. OPEN SOURCE VULNERABILITY DATABASE (OSVDB) : 60685
8. Common Weakness Enumeration (CWE) : Information Leak (CWE-200) [IPA Evaluation]

[2009/12/07]
  Web page published