CVE-2017-2117

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

Directory traversal vulnerability in CubeCart versions prior to 6.1.5 allows attacker with administrator rights to read arbitrary files via unspecified vectors.

Metrics

CVSS 3.0 4.9/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
CubeCart Limited	CubeCart	versions prior to 6.1.5

References

http://jvn.jp/en/jp/JVN63474730/index.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/96466Third Party Advisory, VDB Entry
https://forums.cubecart.com/topic/52188-cubecart-615-released/Patch, Release Notes
http://jvn.jp/en/jp/JVN63474730/index.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/96466Third Party Advisory, VDB Entry
https://forums.cubecart.com/topic/52188-cubecart-615-released/Patch, Release Notes

Timeline

Published: Apr 28, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-21186.1Cross-site scripting vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspeci CVE-2017-21198.6Directory traversal vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to read arbitrary files via unspecified vectors.CVE-2017-21207.2SQL injection vulnerability in the WBCE CMS 1.1.10 and earlier allows attacker with administrator rights to execute arbitrary SQL commands v CVE-2017-21225.4Cross-site scripting vulnerability in Nessus versions 6.8.0, 6.8.1, 6.9.0, 6.9.1 and 6.9.2 allows remote authenticated attackers to inject a CVE-2017-21236.1Cross-site scripting vulnerability in OneThird CMS v1.73 Heaven's Door and earlier allows remote attackers to inject arbitrary web script or CVE-2017-21246.1Cross-site scripting vulnerability in OneThird CMS v1.73 Heaven's Door and earlier allows remote attackers to inject arbitrary web script or CVE-2017-21258.8Privilege escalation vulnerability in CentreCOM AR260S V2 remote authenticated attackers to gain privileges via the guest account.CVE-2017-21269.8WAPM-1166D firmware Ver.1.2.7 and earlier, WAPM-APG600H firmware Ver.1.16.1 and earlier allows remote attackers to bypass authentication and CVE-2017-21275.4Cross-site scripting vulnerability in YOP Poll versions prior to 5.8.1 allows remote attackers to inject arbitrary web script or HTML via un CVE-2017-21288.8Security guide for website operators allows remote attackers to execute arbitrary OS commands via specially crafted saved data.CVE-2017-21307.8Untrusted search path vulnerability in the installer of PhishWall Client Internet Explorer version Ver. 3.7.13 and earlier allows remote att CVE-2017-21315.3Panasonic KX-HJB1000 Home unit devices with firmware GHX1YG 14.50 or HJB1000_4.47 allow an attacker to bypass access restrictions to view th