JVN#17849447: EC-CUBE vulnerable to information alteration

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an information alteration vulnerability.

Impact

User’s information may be altered by other user who visits the shopping site.

Solution

Apply the update or the patch
Apply the update or the patch according to the information provided by the developer.

Products Affected

• EC-CUBE 2.4.4 and earlier

• EC-CUBE 2.11.0

• EC-CUBE 2.11.1

• EC-CUBE 2.11.2

• EC-CUBE 2.11.3

• EC-CUBE 2.11.4

• EC-CUBE 2.11.5

• EC-CUBE 2.12.0

• EC-CUBE 2.12.1

• EC-CUBE 2.12.2