GHSA-j2hg-w4p4-6rvmMediumCVSS 5.3

EC-CUBE vulnerable to authorization bypass

Published
May 17, 2022
Last Modified
June 11, 2024

🔗 CVE IDs covered (1)

CVE-2014-0808 →

📋 Description

Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is exploited, a user of the affected shopping website may obtain other users' information by sending a crafted HTTP request.

🎯 Affected products1

  • composer/ec-cube/ec-cube:>= 2.11.0, < 2.12.2

🔗 References (8)