CVE-2014-0808: EC-CUBE Authorization Bypass Vulnerability
Summary
CVE-2014-0808: EC-CUBE vulnerable to authorization bypass. Affects ec-cube/ec-cube versions >= 2.11.0, < 2.12.2. Fixed in 2.12.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
EC-CUBE is an open-source e-commerce platform written in PHP. It provides a comprehensive set of features for building and managing online shopping websites. The vulnerability described here affects EC-CUBE versions 2.11.0 through 2.12.2, as well as EC-Orange systems deployed before June 29th, 2015. EC-CUBE allows users to obtain other users' information by exploiting an authorization bypass vulnerability through a user-controlled key in crafted HTTP requests.
Vulnerability Detail
The vulnerability in EC-CUBE allows an attacker to bypass the authorization mechanism and gain unauthorized access to other users' information. By sending a specially crafted HTTP request with a user-controlled key, an attacker can trick the system into granting access to sensitive data. This can lead to the exposure of personal information, such as names, addresses, and payment details, of other users on the affected shopping website. The vulnerability has a CVSSv3 score of 5.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.12.2
This is the first release that contains the fix.
composer require ec-cube/ec-cube:2.12.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official patch or upgrade to a fixed version of EC-CUBE to ensure the security of the system.
Conclusion
The EC-CUBE authorization bypass vulnerability allows attackers to access sensitive user information on affected shopping websites. To mitigate this risk, it is recommended to upgrade EC-CUBE to version 2.12.3 or later. Alternatively, users can apply the official patch provided by the EC-CUBE project. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ec-cube/ec-cube →
FAQ
EC-CUBE is an open-source e-commerce platform used for building and managing online shopping websites.
EC-CUBE versions 2.11.0 through 2.12.2, as well as EC-Orange systems deployed before June 29th, 2015, are vulnerable to this authorization bypass issue.
By exploiting this vulnerability, an attacker can obtain other users' information, including personal details and payment information, on the affected shopping website.
No, there is no known workaround for this vulnerability. It is crucial to apply the official patch or upgrade to a fixed version of EC-CUBE.
The vulnerability has a CVSSv3 score of 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ec-cube/ec-cube.
