PT-2023-20569 · Oxid · Oxid Eshop

Publicado 2023-04-11 · Atualizado 2023-04-19 · CVE-2023-26260

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OXID eShop versions 6.2.x through 6.4.3 OXID eShop versions 6.5.x through 6.5.1

Description The issue allows session hijacking, leading to partial access of a customer's account by an attacker, due to an improper check of the user agent.

Recommendations For OXID eShop versions 6.2.x through 6.4.3, update to version 6.4.4 or later. For OXID eShop versions 6.5.x through 6.5.1, update to version 6.5.2 or later.

Correção

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

CVE-2023-26260

Produtos afetados

Oxid Eshop

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-26260 · Nota de Segurança
• https://t.me/cvenotify/48049 · Publicação no Telegram
• https://docs.oxid-esales.com/de/security/security-bulletins.html#security-bulletin-2023-001 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-26260 · Aviso do Fabricante