CVE-2013-3652: XSS

Published Jun 29, 2013

Updated

Cross-site scripting (XSS) vulnerability in data/class/pages/products/LCPageProductsList.php in LOCKON EC-CUBE 2.11.0 through 2.12.4 allows remote attackers to inject arbitrary web script or HTML via vectors involving the classcategoryid2 field, a different vulnerability than CVE-2013-3653.

Affected Software

11 affected components

LOCKON EC-CUBE=2.11.0

LOCKON EC-CUBE=2.11.1

LOCKON EC-CUBE=2.11.2

LOCKON EC-CUBE=2.11.3

LOCKON EC-CUBE=2.11.4

LOCKON EC-CUBE=2.11.5

LOCKON EC-CUBE=2.12.0

LOCKON EC-CUBE=2.12.1

LOCKON EC-CUBE=2.12.2

LOCKON EC-CUBE=2.12.3

LOCKON EC-CUBE=2.12.4

Event History

Jun 29, 2013

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2013-3652?

CVE-2013-3652 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.

How do I fix CVE-2013-3652?

To fix CVE-2013-3652, upgrade your LOCKON EC-CUBE installation to version 2.12.5 or later.

Which versions of LOCKON EC-CUBE are affected by CVE-2013-3652?

LOCKON EC-CUBE versions 2.11.0 through 2.12.4 are affected by CVE-2013-3652.

What is the impact of CVE-2013-3652?

The impact of CVE-2013-3652 allows attackers to inject arbitrary web scripts or HTML, potentially compromising user data.

Is user data at risk with CVE-2013-3652?

Yes, due to the cross-site scripting vulnerability in CVE-2013-3652, there is a risk of user data being exposed to attackers.