NetSight
IP …
medium5.0

CVE-2013-4702

Multiple directory traversal vulnerabilities in the doApiAction function in data/class/api/SC_Api_Operation.php in LOCKON EC-CUBE 2.12.0 through 2.12.5 on Wind…

Impact

Multiple directory traversal vulnerabilities in the doApiAction function in data/class/api/SC_Api_Operation.php in LOCKON EC-CUBE 2.12.0 through 2.12.5 on Windows allow remote attackers to read arbitrary files via vectors involving a (1) Operation, (2) Service, (3) Style, (4) Validate, or (5) Version value.

Affected products

VendorProductAffected versions
LockonEc-Cube
Versions 2.12.0, 2.12.1, 2.12.2, 2.12.3, 2.12.3en, 2.12.3enp1

Weakness classification

CWE-22

References