PT-2018-4228 · Oxid · Oxid Eshop Professional Edition+2

Cesnauskast · Published 2018-01-19 · Updated 2021-01-20 · CVE-2014-4919

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions OXID eShop Professional Edition versions 4.7.13 and earlier, 4.8.x before 4.8.7 OXID eShop Enterprise Edition versions 5.0.13 and earlier, 5.1.x before 5.1.7 OXID eShop Community Edition versions 4.7.13 and earlier, 4.8.x before 4.8.7

Description The issue allows remote attackers to assign users to arbitrary dynamical user groups.

Recommendations For OXID eShop Professional Edition versions 4.7.13 and earlier, update to version 4.7.13 or later. For OXID eShop Professional Edition version 4.8.x before 4.8.7, update to version 4.8.7 or later. For OXID eShop Enterprise Edition versions 5.0.13 and earlier, update to version 5.0.13 or later. For OXID eShop Enterprise Edition version 5.1.x before 5.1.7, update to version 5.1.7 or later. For OXID eShop Community Edition versions 4.7.13 and earlier, update to version 4.7.13 or later. For OXID eShop Community Edition version 4.8.x before 4.8.7, update to version 4.8.7 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-4919

Affected Products

Oxid Eshop Community Edition

Oxid Eshop Enterprise Edition

Oxid Eshop Professional Edition

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-4919 · Security Note
• https://bugs.oxid-esales.com/view.php?id=5814 · Vendor Advisory
• https://oxidforge.org/en/security-bulletin-2014-003.html · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4919 · Note
• https://t.me/cvenotify/8727 · Telegram Post