CVE-2013-2315: Input Validation
Published May 29, 2013
·Updated
data/class/pages/forgot/LCPageForgot.php in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 does not properly validate the input to the password reminder function, which allows remote attackers to obtain sensitive information via a crafted request.
Affected Software
13 affected components
LOCKON EC-CUBE=2.11.0
LOCKON EC-CUBE=2.11.1
LOCKON EC-CUBE=2.11.2
LOCKON EC-CUBE=2.11.3
LOCKON EC-CUBE=2.11.4
LOCKON EC-CUBE=2.11.5
LOCKON EC-CUBE=2.12.0
LOCKON EC-CUBE=2.12.1
LOCKON EC-CUBE=2.12.2
LOCKON EC-CUBE=2.12.3
LOCKON EC-CUBE=2.12.3en
LOCKON EC-CUBE=2.12.3enp1
LOCKON EC-CUBE=2.12.3enp2
Event History
May 29, 2013
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-2315?
CVE-2013-2315 has a medium severity level as it allows attackers to access sensitive information.
2
How does CVE-2013-2315 expose sensitive information?
CVE-2013-2315 exploits improper input validation in the password reminder function.
3
Which versions of LOCKON EC-CUBE are affected by CVE-2013-2315?
CVE-2013-2315 affects LOCKON EC-CUBE versions 2.11.0 through 2.12.3enP2.
4
How can I fix CVE-2013-2315?
To fix CVE-2013-2315, upgrade to the latest version of LOCKON EC-CUBE that is not vulnerable.
5
Is CVE-2013-2315 still a risk if my software is up to date?
If your software is updated to a version beyond 2.12.3enP2, CVE-2013-2315 should no longer pose a risk.