PT-2023-20569 · Oxid · Oxid Eshop

Published 2023-04-11 · Updated 2023-04-19 · CVE-2023-26260

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OXID eShop versions 6.2.x through 6.4.3 OXID eShop versions 6.5.x through 6.5.1

Description The issue allows session hijacking, leading to partial access of a customer's account by an attacker, due to an improper check of the user agent.

Recommendations For OXID eShop versions 6.2.x through 6.4.3, update to version 6.4.4 or later. For OXID eShop versions 6.5.x through 6.5.1, update to version 6.5.2 or later.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2023-26260

Affected Products

Oxid Eshop

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-26260 · Security Note
• https://docs.oxid-esales.com/de/security/security-bulletins.html#security-bulletin-2023-001 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26260 · Vendor Advisory
• https://t.me/cvenotify/48049 · Telegram Post