Vulnerability · Published Jun 19, 2020 · Assigned by jpcert
CVE-2020-5590
High 8.1
In plain English
A high-severity security flaw in EC-CUBE from EC-CUBE CO.,LTD.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)8.1High
Exploit odds (30 days)2.1%top 18.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | ec-cube/ec-cube | no fix listed | GHSA-hx79-x87c-hgm3 |
| Packagist | ec-cube/ec-cube | 4.0.4 | GHSA-hx79-x87c-hgm3 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| EC-CUBE CO.,LTD. | EC-CUBE | 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 |
References
- https://www.ec-cube.net/info/weakness/weakness.php?id=73 x_refsource_MISC
- https://www.ec-cube.net/info/weakness/weakness.php?id=74 x_refsource_MISC
- https://jvn.jp/en/jp/JVN77458946/index.html x_refsource_MISC