GitHub Advisoryadvisory · Packagist

GHSA-wjpv-frf2-3r58 EC-CUBE Directory traversal vulnerability

LOW Published 2022-09-28 Modified 2024-04-25 Official page ↗
Aliases
CVE-2022-40199
Ecosystem
Packagist
Packages
ec-cube/ec-cube
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-22
Reviewed
2024-04-25

Affected packages

• Packagist ec-cube/ec-cube: >= 3.0.0, <= 3.0.18-p4 (no fix yet) • Packagist ec-cube/ec-cube: >= 4.0.0, <= 4.1.2 (no fix yet)

Description

Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated attacker with an administrative privilege to obtain the product's directory structure information.

Related

Alias · CVE (1)

  • CVE-2022-40199 Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References