CVE-2016-1201: CSRF

Published Apr 30, 2016

Updated

Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to hijack the authentication of administrators.

Affected Software

10 affected components

LOCKON EC-CUBE=3.0.0

LOCKON EC-CUBE=3.0.1

LOCKON EC-CUBE=3.0.2

LOCKON EC-CUBE=3.0.3

LOCKON EC-CUBE=3.0.4

LOCKON EC-CUBE=3.0.5

LOCKON EC-CUBE=3.0.6

LOCKON EC-CUBE=3.0.7

LOCKON EC-CUBE=3.0.8

LOCKON EC-CUBE=3.0.9

Remediation

Patch Available

https://www.ec-cube.net/info/weakness/201604/

Event History

Apr 30, 2016

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-1201?

CVE-2016-1201 is a moderate severity cross-site request forgery (CSRF) vulnerability that potentially allows remote attackers to hijack the authentication of administrators.

How do I fix CVE-2016-1201?

To mitigate CVE-2016-1201, upgrade your LOCKON EC-CUBE installation to version 3.1.0 or later where this vulnerability is patched.

Which versions of LOCKON EC-CUBE are affected by CVE-2016-1201?

LOCKON EC-CUBE versions from 3.0.0 to 3.0.9 are affected by CVE-2016-1201.

Can CVE-2016-1201 affect any other systems?

CVE-2016-1201 specifically affects the LOCKON EC-CUBE platform, and other systems are not directly impacted.

What type of attack is possible with CVE-2016-1201?

CVE-2016-1201 allows for cross-site request forgery attacks that can lead to unauthorized actions being performed by an administrator.