CVE-2015-5665: CSRF

Published Oct 27, 2015

Updated

Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.3 allows remote attackers to hijack the authentication of arbitrary users for requests that write to PHP scripts, related to the doValidToken function.

Affected Software

15 affected components

LOCKON EC-CUBE=2.11.0

LOCKON EC-CUBE=2.11.1

LOCKON EC-CUBE=2.11.2

LOCKON EC-CUBE=2.11.3

LOCKON EC-CUBE=2.11.4

LOCKON EC-CUBE=2.11.5

LOCKON EC-CUBE=2.12.0

LOCKON EC-CUBE=2.12.1

LOCKON EC-CUBE=2.12.2

LOCKON EC-CUBE=2.12.3

LOCKON EC-CUBE=2.12.5

LOCKON EC-CUBE=2.12.6

LOCKON EC-CUBE=2.13.0

LOCKON EC-CUBE=2.13.1

LOCKON EC-CUBE=2.13.2

Event History

Oct 27, 2015

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-5665?

CVE-2015-5665 is considered to have a high severity due to its potential for exploitation through CSRF attacks.

How do I fix CVE-2015-5665?

To fix CVE-2015-5665, upgrade to EC-CUBE version 2.13.3 or later, which addresses the vulnerability.

What is the impact of CVE-2015-5665?

The impact of CVE-2015-5665 allows attackers to hijack user authentication for sensitive requests, compromising user accounts.

Which versions are affected by CVE-2015-5665?

CVE-2015-5665 affects LOCKON EC-CUBE versions from 2.11.0 to 2.13.3, including intermediary versions.

Can CVE-2015-5665 be exploited remotely?

Yes, CVE-2015-5665 can be exploited remotely by attackers to perform unauthorized actions on behalf of the user.