What is the severity of CVE-2008-6878?

CVE-2008-6878 is considered a medium severity vulnerability due to its impact on file inclusion and arbitrary code execution.

How do I fix CVE-2008-6878?

To fix CVE-2008-6878, upgrade Zen Cart to the latest version that addresses this vulnerability or implement restrictions to prevent directory traversal.

What versions of Zen Cart are affected by CVE-2008-6878?

CVE-2008-6878 affects Zen Cart versions 1.3.8 and 1.3.8a, as well as earlier versions.

Can CVE-2008-6878 lead to remote code execution?

Yes, CVE-2008-6878 can allow remote attackers to include and execute arbitrary local files, potentially leading to remote code execution.

Is CVE-2008-6878 easily exploitable?

Yes, CVE-2008-6878 can be easily exploited by manipulating the _SESSION[language] parameter if .htaccess is not supported.

Vulnerability/
CVE-2008-6878

medium

6.8

CWE

27/7/2009

7/8/2024

CVE-2008-6878: Path Traversal

First published: Mon Jul 27 2009(Updated: 7 months ago)

** DISPUTED ** Directory traversal vulnerability in admin/includes/languages/english.php in Zen Cart 1.3.8a, 1.3.8, and earlier, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the _SESSION[language] parameter. NOTE: the vendor disputes this issue, stating "at worst, the use of this vulnerability will reveal some local file paths."

Credit: cve@mitre.org

Affected Software	Affected Version	How to fix
Zen Cart	=1.3.8
Zen Cart	=1.3.8a

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2008-6878?
CVE-2008-6878 is considered a medium severity vulnerability due to its impact on file inclusion and arbitrary code execution.
How do I fix CVE-2008-6878?
To fix CVE-2008-6878, upgrade Zen Cart to the latest version that addresses this vulnerability or implement restrictions to prevent directory traversal.
What versions of Zen Cart are affected by CVE-2008-6878?
CVE-2008-6878 affects Zen Cart versions 1.3.8 and 1.3.8a, as well as earlier versions.
Can CVE-2008-6878 lead to remote code execution?
Yes, CVE-2008-6878 can allow remote attackers to include and execute arbitrary local files, potentially leading to remote code execution.
Is CVE-2008-6878 easily exploitable?
Yes, CVE-2008-6878 can be easily exploited by manipulating the _SESSION[language] parameter if .htaccess is not supported.

agent/references
agent/type
agent/severity
agent/weakness
agent/status
agent/softwarecombine
agent/description
collector/mitre-cve
source/MITRE
agent/first-publish-date
agent/event
agent/last-modified-date
agent/source
agent/tags
collector/nvd-api
source/NVD
agent/software-canonical-lookup
agent/software-canonical-lookup-request
collector/nvd-historical
collector/nvd-index
agent/author
vendor/zen cart
canonical/zen cart
version/zen cart/1.3.8
version/zen cart/1.3.8a
status/disputed

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.