Description
Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated attacker with an administrative privilege to obtain the product's directory structure information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| EC-CUBE | EC-CUBE 3 series and EC-CUBE 4 series | EC-CUBE 3.0.0 to 3.0.18-p4 and EC-CUBE 4.0.0 to 4.1.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | ec-cube/ec-cube | >= 3.0.0, <= 3.0.18-p4 | — | GHSA-wjpv-frf2-3r58 |
| Packagist | ec-cube/ec-cube | >= 4.0.0, <= 4.1.2 | — | GHSA-wjpv-frf2-3r58 |