JVNDB-2013-000042

[Japanese]
JVNDB-2013-000042
EC-CUBE vulnerable to session fixation
Overview
EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a session fixation vulnerability. Yuji Tounai of bogus.jp reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)
CVSS V2 Severity: Base Metrics 4.0 (Medium) [IPA Score] Access Vector: Network Access Complexity: High Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
Affected Products

LOCKON CO.,LTD EC-CUBE 2.11.0 EC-CUBE 2.11.1 EC-CUBE 2.11.2 EC-CUBE 2.11.3 EC-CUBE 2.11.4 EC-CUBE 2.11.5 EC-CUBE 2.12.0 EC-CUBE 2.12.1 EC-CUBE 2.12.2 EC-CUBE 2.12.3 EC-CUBE 2.12.3en EC-CUBE 2.12.3enP1 EC-CUBE 2.12.3enP2

Impact
A remote unauthenticated attacker may impersonate a user. As a result, information may be disclosed or altered.
Solution
[Apply the update or patch] Apply the update or patch according to the information provided by the developer.
Vendor Information
LOCKON CO.,LTD LOCKON CO.,LTD : Cross-site scripting vulnerability in shopping cart screen, and session fixation vulnerability (in Japanese)
CWE (What is CWE?)
Permissions(CWE-264) [IPA Evaluation]
CVE (What is CVE?)
CVE-2013-2313
References
JVN : JVN#00985872 National Vulnerability Database (NVD) : CVE-2013-2313
Revision History
[2013/05/23] Web page was published

EC-CUBE vulnerable to session fixation