Описание
Directory traversal vulnerability in the lfCheckFileName function in data/class/pages/LC_Page_ResizeImage.php in LOCKON EC-CUBE before 2.12.5 allows remote attackers to read arbitrary image files via vectors involving the image parameter to resize_image.php, a different vulnerability than CVE-2013-3654.
Ссылки
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2.12.4 (включая)
Одно из
cpe:2.3:a:lockon:ec-cube:*:*:*:*:*:*:*:*
cpe:2.3:a:lockon:ec-cube:2.12.0:*:*:*:*:*:*:*
cpe:2.3:a:lockon:ec-cube:2.12.1:*:*:*:*:*:*:*
cpe:2.3:a:lockon:ec-cube:2.12.2:*:*:*:*:*:*:*
cpe:2.3:a:lockon:ec-cube:2.12.3:*:*:*:*:*:*:*
EPSS
Процентиль: 54%
0.0032
Низкий
5 Medium
CVSS2
Дефекты
CWE-22
Связанные уязвимости
github
больше 3 лет назад
Directory traversal vulnerability in the lfCheckFileName function in data/class/pages/LC_Page_ResizeImage.php in LOCKON EC-CUBE before 2.12.5 allows remote attackers to read arbitrary image files via vectors involving the image parameter to resize_image.php, a different vulnerability than CVE-2013-3654.
EPSS
Процентиль: 54%
0.0032
Низкий
5 Medium
CVSS2
Дефекты
CWE-22