CVE-2016-1199: Infoleak
Published Apr 30, 2016
·Updated
The login page in the management screen in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to bypass intended IP address restrictions via unspecified vectors, a different vulnerability than CVE-2016-1200.
Affected Software
10 affected components
LOCKON EC-CUBE=3.0.0
LOCKON EC-CUBE=3.0.1
LOCKON EC-CUBE=3.0.2
LOCKON EC-CUBE=3.0.3
LOCKON EC-CUBE=3.0.4
LOCKON EC-CUBE=3.0.5
LOCKON EC-CUBE=3.0.6
LOCKON EC-CUBE=3.0.7
LOCKON EC-CUBE=3.0.8
LOCKON EC-CUBE=3.0.9
Remediation
Patch Available
Event History
Apr 30, 2016
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-1199?
CVE-2016-1199 is considered a medium severity vulnerability due to its potential to allow unauthorized access.
2
How do I fix CVE-2016-1199?
To fix CVE-2016-1199, update LOCKON EC-CUBE to version 3.0.10 or later, where the vulnerability is addressed.
3
What systems are affected by CVE-2016-1199?
CVE-2016-1199 affects LOCKON EC-CUBE versions 3.0.0 to 3.0.9.
4
Can CVE-2016-1199 lead to data breaches?
Yes, CVE-2016-1199 can expose sensitive information by allowing attackers to bypass IP address restrictions.
5
What types of attacks are possible with CVE-2016-1199?
CVE-2016-1199 enables remote attackers to access the management screen, potentially leading to unauthorized administrative actions.