Description
The management screen in LOCKON EC-CUBE 3.0.7 through 3.0.9 allows remote authenticated users to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2016-1199.
References (5)
Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/90503
Vendor Advisory third-party-advisory
x_refsource_jvn
http://jvn.jp/en/jp/JVN11458774/index.html
Vendor Advisory third-party-advisory
x_refsource_jvndb
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000052
Patch, Vendor Advisory x_refsource_confirm
https://www.ec-cube.net/info/weakness/201604/
Vendor Advisory x_refsource_confirm
http://www.ec-cube.net/info/weakness/weakness.php?id=66
Scores
CVSS v3
6.3
EPSS
0.0090
EPSS Percentile
55.2%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Details
CWE
CWE-284
Status
published
Products (3)
lockon/ec-cube
3.0.7
lockon/ec-cube
3.0.8
lockon/ec-cube
3.0.9
Published
Apr 30, 2016
Tracked Since
Feb 18, 2026