CVE-2015-5665 Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.3 allows remote attackers to hijack the authentication of arbitrary users for requests that write to PHP scripts,....
MediumCVSS 5.1
EPSS 0.65%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.3 allows remote attackers to hijack the authentication of arbitrary users for requests that write to PHP scripts, related to the doValidToken function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lockon ec-cube | = 2.11.0 | No fix listed |
| lockon ec-cube | = 2.11.1 | No fix listed |
| lockon ec-cube | = 2.11.2 | No fix listed |
| lockon ec-cube | = 2.11.3 | No fix listed |
| lockon ec-cube | = 2.11.4 | No fix listed |
| lockon ec-cube | = 2.11.5 | No fix listed |
| lockon ec-cube | = 2.12.0 | No fix listed |
| lockon ec-cube | = 2.12.1 | No fix listed |
| lockon ec-cube | = 2.12.2 | No fix listed |
| lockon ec-cube | = 2.12.3 | No fix listed |
| lockon ec-cube | = 2.12.5 | No fix listed |
| lockon ec-cube | = 2.12.6 | No fix listed |
| lockon ec-cube | = 2.13.0 | No fix listed |
| lockon ec-cube | = 2.13.1 | No fix listed |
| lockon ec-cube | = 2.13.2 | No fix listed |
References
- JVN#97278546 third-party-advisory vendor-advisory
- JVNDB-2015-000166 third-party-advisory vendor-advisory
- www.ec-cube.net vendor-advisory
- www.ec-cube.net vendor-advisory