CVE-2013-2312: XSS
Published May 29, 2013
·Updated
Cross-site scripting (XSS) vulnerability in the shopping-cart screen in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Affected Software
13 affected components
LOCKON EC-CUBE=2.11.0
LOCKON EC-CUBE=2.11.1
LOCKON EC-CUBE=2.11.2
LOCKON EC-CUBE=2.11.3
LOCKON EC-CUBE=2.11.4
LOCKON EC-CUBE=2.11.5
LOCKON EC-CUBE=2.12.0
LOCKON EC-CUBE=2.12.1
LOCKON EC-CUBE=2.12.2
LOCKON EC-CUBE=2.12.3
LOCKON EC-CUBE=2.12.3en
LOCKON EC-CUBE=2.12.3enp1
LOCKON EC-CUBE=2.12.3enp2
Event History
May 29, 2013
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-2312?
CVE-2013-2312 is considered a medium severity cross-site scripting vulnerability.
2
How do I fix CVE-2013-2312?
To fix CVE-2013-2312, upgrade LOCKON EC-CUBE to version 2.12.4 or later.
3
What versions of LOCKON EC-CUBE are affected by CVE-2013-2312?
LOCKON EC-CUBE versions 2.11.0 through 2.12.3enP2 are affected by CVE-2013-2312.
4
Who can exploit CVE-2013-2312?
Remote attackers can exploit CVE-2013-2312 to inject arbitrary web script or HTML.
5
What impact does CVE-2013-2312 have on web applications?
CVE-2013-2312 can lead to unauthorized actions or data exposure on web applications using affected versions.