PT-2018-14747 · Oscommerce · Oscommerce

Hexifeo · Publicado 2018-11-06 · Atualizado 2020-08-24 · CVE-2018-18964

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions osCommerce version 2.3.4.1

Description The issue is related to an incomplete '.htaccess' file for blacklist filtering in the product page. Specifically, the .htaccess file in catalog/images/ bans the html extension, but there are several extensions, such as the svg extension, in which contained HTML can be executed.

Recommendations For osCommerce version 2.3.4.1, consider updating the .htaccess file in catalog/images/ to include additional extensions that can execute HTML, such as the svg extension, to prevent potential exploitation. As a temporary workaround, restrict access to the catalog/images/ directory to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2018-18964

Produtos afetados

Oscommerce

Referências · 3

• https://github.com/osCommerce/oscommerce2/issues/631 · Nota
• https://osv.dev/vulnerability/CVE-2018-18964 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-18964 · Nota de Segurança