CVE-2009-4236: Ec-Cube VER2

Medium severity, CVSS 5.0. EPSS: 1.5% chance of exploitation in the next 30 days.

The process function in data/class/pages/admin/customer/LC_Page_Admin_Customer_SearchCustomer.php in EC-CUBE Ver2 2.4.0 RC1 through 2.4.1, and Community Edition r18068 through r18428, allows remote attackers to obtain sensitive information (customer data) via unknown vectors related to sessions.

Affected products

• Ec-Cube Ec-Cube VER2: version 2.4.0 only; version 2.4.1 only; version r18068 only; version r18428 only

Published 2009-12-08. Last modified 2026-06-16.