CVE-2014-0808

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-0808
Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is exploited, a user of the affected shopping website may obtain other users' information by sending a crafted HTTP request.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://jvn.jp/en/jp/JVN51770585/
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000006
http://www.ec-cube.net/info/weakness/weakness.php?id=57 Vendor Advisory
https://ec-orange.jp/
https://jvn.jp/en/jp/JVN15637138/
https://jvndb.jvn.jp/jvndb/JVNDB-2024-000054
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:lockon:ec-cube:2.11.0:*:*:*:*:*:*:*
cpe:2.3:a:lockon:ec-cube:2.11.0:beta:*:*:*:*:*:*
cpe:2.3:a:lockon:ec-cube:2.11.0:beta2:*:*:*:*:*:*
cpe:2.3:a:lockon:ec-cube:2.11.1:*:*:*:*:*:*:*
cpe:2.3:a:lockon:ec-cube:2.11.2:*:*:*:*:*:*:*
cpe:2.3:a:lockon:ec-cube:2.11.3:*:*:*:*:*:*:*
cpe:2.3:a:lockon:ec-cube:2.11.4:*:*:*:*:*:*:*
cpe:2.3:a:lockon:ec-cube:2.11.5:*:*:*:*:*:*:*
cpe:2.3:a:lockon:ec-cube:2.12.0:*:*:*:*:*:*:*
cpe:2.3:a:lockon:ec-cube:2.12.1:*:*:*:*:*:*:*
cpe:2.3:a:lockon:ec-cube:2.12.2:*:*:*:*:*:*:*
History

03 Jul 2024, 01:35

Type Values Removed Values Added
CVSS v2 : 5.0
v3 : unknown 		v2 : 5.0
v3 : 9.1
CWE CWE-566

11 Jun 2024, 06:15

Type Values Removed Values Added
References
  • {'url': 'http://jvn.jp/en/jp/JVN51770585/index.html', 'source': 'vultures@jpcert.or.jp'}
  • () http://jvn.jp/en/jp/JVN51770585/ -
  • () https://ec-orange.jp/ -
  • () https://jvn.jp/en/jp/JVN15637138/ -
  • () https://jvndb.jvn.jp/jvndb/JVNDB-2024-000054 -
Summary (en) The lfCheckError function in data/class/pages/shopping/LC_Page_Shopping_Multiple.php in LOCKON EC-CUBE 2.11.0 through 2.12.2 allows remote attackers to obtain sensitive shipping information via unspecified vectors. (en) Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is exploited, a user of the affected shopping website may obtain other users' information by sending a crafted HTTP request.
Information

Published : 2014-01-22 21:55

Updated : 2024-07-03 01:35

NVD link : CVE-2014-0808

Mitre link : CVE-2014-0808

CVE.ORG link : CVE-2014-0808

JSON object : View

Products Affected

lockon

  • ec-cube
CWE
NVD-CWE-noinfo CWE-566

Authorization Bypass Through User-Controlled SQL Primary Key