Skip to content
OpenAdvisories
Unscored CVE-2013-4702 EUVD-2013-4554GHSA-jfxq-mqxh-332w

Multiple directory traversal vulnerabilities in the doApiAction function in data/class/api/SC_Api_Operation.php in LOCKON EC-CUBE 2.12.0 th…

Published Aug 30, 2013 · Updated Aug 6, 2024 · Assigned by jpcert

Description

Multiple directory traversal vulnerabilities in the doApiAction function in data/class/api/SC_Api_Operation.php in LOCKON EC-CUBE 2.12.0 through 2.12.5 on Windows allow remote attackers to read arbitrary files via vectors involving a (1) Operation, (2) Service, (3) Style, (4) Validate, or (5) Version value.

References