PT-2013-5866 · Oxid · Oxid Eshop

Publicado 2013-10-15 · Atualizado 2018-03-22 · CVE-2013-5913

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OXID eShop versions prior to 4.6.7 OXID eShop Professional and Community Edition versions prior to 4.7.8 OXID eShop Enterprise Edition versions prior to 5.0.8

Description The issue is related to a cross-site scripting (XSS) vulnerability in the getRecommSearch function in recommlist.php. This allows remote attackers to inject arbitrary web script or HTML via the searchrecomm parameter.

Recommendations For OXID eShop versions prior to 4.6.7, update to version 4.6.7 or later. For OXID eShop Professional and Community Edition versions prior to 4.7.8, update to version 4.7.8 or later. For OXID eShop Enterprise Edition versions prior to 5.0.8, update to version 5.0.8 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2013-5913

Produtos afetados

Oxid Eshop

Referências · 7

• http://wiki.oxidforge.org/Security_bulletins/2013-001 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-5913 · Nota de Segurança
• http://securityfocus.com/bid/62901 · Nota
• http://osvdb.org/98235 · Nota
• http://secunia.com/advisories/55193 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5913 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/87760 · Nota