CVE-2013-3650: Path Traversal
Published Jun 29, 2013
·Updated
Directory traversal vulnerability in the lfCheckFileName function in data/class/pages/LCPageResizeImage.php in LOCKON EC-CUBE before 2.12.5 allows remote attackers to read arbitrary image files via vectors involving the image parameter to resizeimage.php, a different vulnerability than CVE-2013-3654.
Affected Software
5 affected components
LOCKON EC-CUBE<=2.12.4
LOCKON EC-CUBE=2.12.0
LOCKON EC-CUBE=2.12.1
LOCKON EC-CUBE=2.12.2
LOCKON EC-CUBE=2.12.3
Event History
Jun 29, 2013
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-3650?
CVE-2013-3650 has a high severity rating due to its potential to allow unauthorized file access.
2
How do I fix CVE-2013-3650?
To fix CVE-2013-3650, upgrade LOCKON EC-CUBE to version 2.12.5 or later.
3
What versions of LOCKON EC-CUBE are affected by CVE-2013-3650?
CVE-2013-3650 affects LOCKON EC-CUBE versions 2.12.0 through 2.12.4.
4
Can CVE-2013-3650 be exploited remotely?
Yes, CVE-2013-3650 can be exploited remotely by attackers to read arbitrary image files.
5
What type of vulnerability is CVE-2013-3650?
CVE-2013-3650 is categorized as a directory traversal vulnerability.