CVE-2013-5991: Infoleak
Published Nov 21, 2013
·Updated
The displaySystemError function in html/handleerror.php in LOCKON EC-CUBE 2.11.0 through 2.11.5 allows remote attackers to obtain sensitive information by leveraging incorrect handling of error-log output.
Affected Software
8 affected components
LOCKON EC-CUBE=2.11.0
LOCKON EC-CUBE=2.11.0-beta
LOCKON EC-CUBE=2.11.0-beta2
LOCKON EC-CUBE=2.11.1
LOCKON EC-CUBE=2.11.2
LOCKON EC-CUBE=2.11.3
LOCKON EC-CUBE=2.11.4
LOCKON EC-CUBE=2.11.5
Remediation
Patch Available
Event History
Nov 21, 2013
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-5991?
CVE-2013-5991 is considered a moderate severity vulnerability due to its potential to expose sensitive information.
2
How do I fix CVE-2013-5991?
To fix CVE-2013-5991, users should upgrade to EC-CUBE version 2.11.6 or later where the vulnerability is resolved.
3
What software versions are affected by CVE-2013-5991?
CVE-2013-5991 affects LOCKON EC-CUBE versions from 2.11.0 to 2.11.5.
4
Who can exploit CVE-2013-5991?
CVE-2013-5991 can be exploited by remote attackers who can potentially access sensitive error-log information.
5
What kind of information can be leaked by CVE-2013-5991?
CVE-2013-5991 can lead to the exposure of sensitive information that's logged in error logs due to improper handling.