« Volver al listado

CVE-2009-4236

Estado: ModificadaMedia (5)—

The process function in data/class/pages/admin/customer/LC_Page_Admin_Customer_SearchCustomer.php in EC-CUBE Ver2 2.4.0 RC1 through 2.4.1, and Community Edition r18068 through r18428, allows remote attackers to obtain sensitive information (customer data) via unknown vectors related to sessions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Ec-cube — Ec-cube Ver2

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-4236",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-12-08T23:30:00.360",
  "references": [
    {
      "url": "http://jvn.jp/en/jp/JVN79762947/index.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000078.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/60685",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/37603",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.ec-cube.net/info/091127/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.ipa.go.jp/security/vuln/documents/2009/200912_ec-cube.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/3421",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54573",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://jvn.jp/en/jp/JVN79762947/index.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000078.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/60685",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/37603",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ec-cube.net/info/091127/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ipa.go.jp/security/vuln/documents/2009/200912_ec-cube.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/3421",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54573",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The process function in data/class/pages/admin/customer/LC_Page_Admin_Customer_SearchCustomer.php in EC-CUBE Ver2 2.4.0 RC1 through 2.4.1, and Community Edition r18068 through r18428, allows remote attackers to obtain sensitive information (customer data) via unknown vectors related to sessions."
    },
    {
      "lang": "es",
      "value": "La función process en data/class/pages/admin/customer/LC_Page_Admin_Customer_SearchCustomer.php en EC-CUBE Ver2 v2.4.0 RC1 hasta v2.4.1, y Community Edition r18068 hasta r18428, permite a atacantes remotos obtener información sensible (datos clientes) a través de vectores desconocidos relacionados con sesiones."
    }
  ],
  "lastModified": "2026-06-16T23:13:17.937",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube_ver2:2.4.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "536E6C78-F1CC-4017-BDD4-9D9AF1AE65BF"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube_ver2:2.4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C7C61A12-C1C3-4BDA-A5EC-7003B5086D35"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube_ver2:r18068:-:community:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C16B9092-95C1-4C98-AFAB-B4177D14A38D"
            },
            {
              "criteria": "cpe:2.3:a:ec-cube:ec-cube_ver2:r18428:-:community:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "605AFB79-2B78-436A-A522-09DCC275C71D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}