CVE-2014-0808: Critical severity LOCKON EC-CUBE vulnerability
Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is exploited, a user of the affected shopping website may obtain other users' information by sending a crafted HTTP request.
Other sources
The lfCheckError function in data/class/pages/shopping/LCPageShoppingMultiple.php in LOCKON EC-CUBE 2.11.0 through 2.12.2 allows remote attackers to obtain sensitive shipping information via unspecified vectors.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/ec-cube/ec-cubeto a version that resolves this vulnerability.Fixed in 2.12.2
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0808?
CVE-2014-0808 has a medium severity level due to its potential for unauthorized information access.
How do I fix CVE-2014-0808?
To fix CVE-2014-0808, upgrade to EC-CUBE version 2.12.2 or later.
What versions of EC-CUBE are affected by CVE-2014-0808?
CVE-2014-0808 affects EC-CUBE versions 2.11.0 through 2.12.2.
What impact does CVE-2014-0808 have?
CVE-2014-0808 allows an attacker to bypass authorization and access other users' personal information.
When was CVE-2014-0808 discovered?
CVE-2014-0808 was disclosed on February 10, 2014.