PT-2018-17134 · Oxid+1 · Oxid Eshop Enterprise Edition+1

Timo Terhaar · Published 2018-02-19 · Updated 2018-03-20 · CVE-2018-5763

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: OXID eShop Enterprise Edition versions prior to 5.3.7 OXID eShop Enterprise Edition versions 6.x prior to 6.0.1

Description: An issue allows an attacker to bring the shop server to a standstill by entering specially crafted URLs. This issue is only applicable if the OXID High Performance Option is activated and Varnish is used.

Recommendations: For OXID eShop Enterprise Edition versions prior to 5.3.7, update to version 5.3.7 or later. For OXID eShop Enterprise Edition versions 6.x prior to 6.0.1, update to version 6.0.1 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-5763

Affected Products

Oxid Eshop Enterprise Edition

Varnish

References · 3

• https://oxidforge.org/en/security-bulletin-2018-001.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-5763 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5763 · Security Note