EC-CUBE 'LC_Page_ResizeImage.php' Directory Traversal Vulnerability

Bugtraq ID:	60849
Class:	Input Validation Error
CVE:	CVE-2013-3650
Remote:	Yes
Local:	No
Published:	Jun 27 2013 12:00AM
Updated:	Jun 27 2013 12:00AM
Credit:	Gen Sato
Vulnerable:	EC-CUBE EC-CUBE 2.12.4 EC-CUBE EC-CUBE 2.12.3 EC-CUBE EC-CUBE 2.12.2 EC-CUBE EC-CUBE 2.12.1 EC-CUBE EC-CUBE 2.12 EC-CUBE EC-CUBE 2.11.5 EC-CUBE EC-CUBE 2.11.3 EC-CUBE EC-CUBE 2.11.2 EC-CUBE EC-CUBE 2.11.1 EC-CUBE EC-CUBE 2.11 EC-CUBE EC-CUBE 2.4.2 EC-CUBE EC-CUBE 2.4.1 EC-CUBE EC-CUBE 2.3 EC-CUBE EC-CUBE 1.4.7 EC-CUBE EC-CUBE 1.4.6 EC-CUBE EC-CUBE 1.0 EC-CUBE EC-CUBE 2.3.0-rc1 EC-CUBE EC-CUBE 2.2.0-beta EC-CUBE EC-CUBE 2.12.4en EC-CUBE EC-CUBE 2.12.3enP2 EC-CUBE EC-CUBE 2.12.3enP1 EC-CUBE EC-CUBE 2.12.3en EC-CUBE EC-CUBE 2.1.2a EC-CUBE EC-CUBE 2.1.1-beta EC-CUBE EC-CUBE 1.5.0-beta2 EC-CUBE EC-CUBE 1.5.0-beta EC-CUBE EC-CUBE 1.0.1a beta
Not Vulnerable:	EC-CUBE EC-CUBE 2.12.5

EC-CUBE 'LC_Page_ResizeImage.php' Directory Traversal Vulnerability

Attackers can exploit this issue with a web browser or readily available tools.

EC-CUBE 'LC_Page_ResizeImage.php' Directory Traversal Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

EC-CUBE 'LC_Page_ResizeImage.php' Directory Traversal Vulnerability

References:

• Directory Traversal Vulnerability (EC-CUBE)
  
• EC-CUBE Homepage (LOCKON CO. LTD.)
  
• JVNDB-2013-000061 EC-CUBE vulnerable to directory traversal (IPA)
  
• JVN#43886811 EC-CUBE vulnerable to directory traversal (JPCERT/CC and IPA)