CVE-2013-3654: Path Traversal
Published Jun 29, 2013
·Updated
Directory traversal vulnerability in LOCKON EC-CUBE 2.12.0 through 2.12.4 allows remote attackers to read arbitrary image files via vectors related to data/class/SCCheckError.php and data/class/SCFormParam.php, a different vulnerability than CVE-2013-3650.
Affected Software
5 affected components
LOCKON EC-CUBE=2.12.0
LOCKON EC-CUBE=2.12.1
LOCKON EC-CUBE=2.12.2
LOCKON EC-CUBE=2.12.3
LOCKON EC-CUBE=2.12.4
Event History
Jun 29, 2013
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-3654?
CVE-2013-3654 is categorized with a moderate severity level, allowing unauthorized file access.
2
How do I fix CVE-2013-3654?
To fix CVE-2013-3654, upgrade to LOCKON EC-CUBE version 2.12.5 or later.
3
What versions of LOCKON EC-CUBE are affected by CVE-2013-3654?
CVE-2013-3654 affects versions 2.12.0 through 2.12.4 of LOCKON EC-CUBE.
4
What types of attacks does CVE-2013-3654 allow?
CVE-2013-3654 allows attackers to perform directory traversal attacks to read arbitrary image files.
5
Is CVE-2013-3654 related to any other vulnerabilities?
CVE-2013-3654 is a different vulnerability from CVE-2013-3650, despite both being in the same software.