PT-2018-5400 · Oxid · Oxid Eshop Community Edition+2
Published
2018-02-20
·
Updated
2018-03-16
·
CVE-2017-12415
CVSS v3.1
7.5
High
| Vector | AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
OXID eShop Community Edition versions 4.9.x through 4.9.9 and 4.10.x through 4.10.4
OXID eShop Enterprise Edition versions 5.2.x through 5.2.9 and 5.3.x through 5.3.4
OXID eShop Professional Edition versions 4.9.x through 4.9.9 and 4.10.x through 4.10.4
Description:
The issue allows remote attackers to hijack the cart session of a client via Cross-Site Request Forgery (CSRF) under specific pre-conditions. These pre-conditions include the attacker knowing which shop the client is using, the exact time the customer will add products to the cart, the product items already in the cart (including their article IDs), and the ability to trick the user into clicking a button or submitting a form within a specific time frame.
Recommendations:
For OXID eShop Community Edition versions 4.9.x through 4.9.9, update to version 4.9.10 or later.
For OXID eShop Community Edition versions 4.10.x through 4.10.4, update to version 4.10.5 or later.
For OXID eShop Enterprise Edition versions 5.2.x through 5.2.9, update to version 5.2.10 or later.
For OXID eShop Enterprise Edition versions 5.3.x through 5.3.4, update to version 5.3.5 or later.
For OXID eShop Professional Edition versions 4.9.x through 4.9.9, update to version 4.9.10 or later.
For OXID eShop Professional Edition versions 4.10.x through 4.10.4, update to version 4.10.5 or later.
Exploit
Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Oxid Eshop Community Edition
Oxid Eshop Enterprise Edition
Oxid Eshop Professional Edition