CVE-2013-3654

MEDIUM 5.0CVE-2013-3654 · Published 30/06/2013 · updated 16/06/2026

In short

CVE-2013-3654 is a MEDIUM (CVSS 5.0) vulnerability affecting ec-cube (lockon).
Chance of exploitation in the next 30 days (EPSS): 1.9%, higher than 79.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
ec-cube lockon	`= 2.12.0= 2.12.1= 2.12.2= 2.12.3= 2.12.4`	No fix yet

Description

Directory traversal vulnerability in LOCKON EC-CUBE 2.12.0 through 2.12.4 allows remote attackers to read arbitrary image files via vectors related to data/class/SC_CheckError.php and data/class/SC_FormParam.php, a different vulnerability than CVE-2013-3650.

References

jvn.jp/en/jp/JVN04161229/index.html
jvndb.jvn.jp/jvndb/JVNDB-2013-000065
svn.ec-cube.net/open_trac/changeset/22891 · Vendor Advisory
ec-cube.net/info/weakness/20130626/index.php
ec-cube.net/info/weakness/weakness.php · Vendor Advisory

More vulnerabilities in ec-cube

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

ec-cube

lockon

= 2.12.0= 2.12.1= 2.12.2= 2.12.3= 2.12.4

No fix yet

More vulnerabilities in ec-cube

See all →