PT-2023-26365 · Oxid · Oxid Eshop Enterprise Edition

Published 2023-08-02 · Updated 2023-08-08 · CVE-2023-38330

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions OXID eShop Enterprise Edition versions 6.5.0 through 6.5.2

Description The issue allows uploading files with modified headers in the administration area, enabling an attacker to create a HTTP Response Splitting attack by uploading a file with a modified header.

Recommendations For versions 6.5.0 through 6.5.2, update to version 6.5.3 or later to resolve the issue. As a temporary workaround, consider restricting file uploads in the administration area until a patch is available.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-38330

Affected Products

Oxid Eshop Enterprise Edition

References · 6

• https://docs.oxid-esales.com/de/security/security-bulletins.html#security-bulletin-2023-002 · Vendor Advisory
• https://bugs.oxid-esales.com/view.php?id=7479 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-38330 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38330 · Security Note
• https://t.me/cibsecurity/67591 · Telegram Post
• https://t.me/cvenotify/55999 · Telegram Post