PT-2013-5866 · Oxid · Oxid Eshop

Published 2013-10-15 · Updated 2018-03-22 · CVE-2013-5913

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OXID eShop versions prior to 4.6.7 OXID eShop Professional and Community Edition versions prior to 4.7.8 OXID eShop Enterprise Edition versions prior to 5.0.8

Description The issue is related to a cross-site scripting (XSS) vulnerability in the getRecommSearch function in recommlist.php. This allows remote attackers to inject arbitrary web script or HTML via the searchrecomm parameter.

Recommendations For OXID eShop versions prior to 4.6.7, update to version 4.6.7 or later. For OXID eShop Professional and Community Edition versions prior to 4.7.8, update to version 4.7.8 or later. For OXID eShop Enterprise Edition versions prior to 5.0.8, update to version 5.0.8 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-5913

Affected Products

Oxid Eshop

References · 7

• http://wiki.oxidforge.org/Security_bulletins/2013-001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-5913 · Security Note
• http://secunia.com/advisories/55193 · Vendor Advisory
• http://securityfocus.com/bid/62901 · Note
• http://osvdb.org/98235 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5913 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/87760 · Note