CVE-2020-5590: EC-CUBE Directory Traversal Vulnerability
Summary
CVE-2020-5590: EC-CUBE Directory traversal vulnerability. Affects ec-cube/ec-cube across 2 version ranges.
>= 3.0.0, <= 3.0.18
>= 4.0.0, < 4.0.4
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
EC-CUBE is an open-source e-commerce platform written in PHP. It provides various features for building and managing online stores. The vulnerability in EC-CUBE versions 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server. This vulnerability can be exploited through unspecified vectors.
Vulnerability Detail
The directory traversal vulnerability in EC-CUBE allows authenticated attackers to traverse the file system and delete files and directories outside of the intended scope. This can lead to unauthorized access, data loss, and potential compromise of the server. The vulnerability has a CVSS score of 8.1, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by upgrading to the latest version of EC-CUBE.
Conclusion
The EC-CUBE directory traversal vulnerability can lead to unauthorized access and data loss. It is crucial for users to upgrade to the latest version of EC-CUBE (4.0.4 or later) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ec-cube/ec-cube →
FAQ
EC-CUBE is an open-source e-commerce platform written in PHP. It provides features for building and managing online stores.
A directory traversal vulnerability allows an attacker to access files and directories outside of the intended scope, potentially leading to unauthorized access and data loss.
The vulnerability can be exploited by authenticated attackers through unspecified vectors, allowing them to delete arbitrary files and directories on the server.
The vulnerability has a CVSS score of 8.1, indicating a high severity level.
To fix the vulnerability, it is recommended to upgrade to EC-CUBE version 4.0.4 or later, which includes a fix for the directory traversal vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for ec-cube/ec-cube.
