EC-CUBE CVE-2013-2314 Authorization Security Bypass Vulnerability

Bugtraq ID:	60113
Class:	Access Validation Error
CVE:	CVE-2013-2314
Remote:	Yes
Local:	No
Published:	May 23 2013 12:00AM
Updated:	May 23 2013 12:00AM
Credit:	Gen Sato
Vulnerable:	EC-CUBE EC-CUBE 2.11.3 EC-CUBE EC-CUBE 2.11.2 EC-CUBE EC-CUBE 2.11.1 EC-CUBE EC-CUBE 2.11
Not Vulnerable:

EC-CUBE CVE-2013-2314 Authorization Security Bypass Vulnerability

EC-CUBE is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks.

EC-CUBE 2.11.0 and later are vulnerable.

EC-CUBE CVE-2013-2314 Authorization Security Bypass Vulnerability

An attacker can exploit this issue using a web browser.

EC-CUBE CVE-2013-2314 Authorization Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

EC-CUBE CVE-2013-2314 Authorization Security Bypass Vulnerability

References:

• EC-CUBE Homepage (LOCKON CO. LTD.)
  
• In some environment, vulnerability improper authentication of management screen (LOCKON CO. LTD.)
  
• JVN#45306814 EC-CUBE fails to restrict access permissions (JPCERT/CC and IPA)
  
• JVNDB-2013-000043 EC-CUBE fails to restrict access permissions (IPA)