OXID eShop user impersonation vulnerability

ALTO 7.5CVE-2015-6926 · GHSA-4c39-hj99-5h2r · Published 19/01/2018 · updated 17/06/2026

Em resumo

CVE-2015-6926 é uma vulnerabilidade ALTO (CVSS 7.5) que afeta oxid-esales/oxideshop-ce, eshop (oxid-esales).
Chance de exploração nos próximos 30 dias (EPSS): 1.1%, maior que 64.9% das vulnerabilidades.
Correção: atualize para 4.5.0 ou posterior.

Package	Affected versions	Patched versions
oxid-esales/oxideshop-ce Packagist	`< 4.5.0`	`4.5.0`
eshop oxid-esales	`≥ 4.0.1.0, ≤ 4.4.8`	No fix yet

Description

The OpenID Single Sign-On authentication functionality in OXID eShop before 4.5.0 allows remote attackers to impersonate users via the email address in a crafted authentication token.

NVD description

The OpenID Single Sign-On authentication functionality in OXID eShop before 4.5.0 allows remote attackers to impersonate users via the email address in a crafted authentication token.

References

nvd.nist.gov/vuln/detail/CVE-2015-6926 · ADVISORY
bugs.oxid-esales.com/view.php · WEB
OXID-eSales/oxideshop_ce · PACKAGE
oxidforge.org/en/oxid-security-bulletin-2015-001.html · WEB

Mais vulnerabilidades de oxid-esales/oxideshop-ce

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free