CVE-2017-12415
Description
OXID eShop Community Edition before 6.0.0 RC2 (development), 4.10.x before 4.10.5 (maintenance), and 4.9.x before 4.9.10 (legacy), Enterprise Edition before 6.0.0 RC2 (development), 5.2.x before 5.2.10 (legacy), and 5.3.x before 5.3.5 (maintenance), and Professional Edition before 6.0.0 RC2 (development), 4.9.x before 4.9.10 (legacy) and 4.10.x before 4.10.5 (maintenance) allow remote attackers to hijack the cart session of a client via Cross-Site Request Forgery (CSRF) if the following pre-conditions are met: (1) the attacker knows which shop is presently used by the client, (2) the attacker knows the exact time when the customer will add product items to the cart, (3) the attacker knows which product items are already in the cart (has to know their article IDs), and (4) the attacker would be able to trick user into clicking a button (submit form) of an e-mail or remote site within the period of visiting the shop and placing an order.
How to fix
- oxid-esales eshop4.9.10, 4.10.5, 5.2.10, 5.3.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oxid-esales eshop | 4.9.0 ≤ v < 4.9.10, 4.10.0 ≤ v < 4.10.5, 5.2.0 ≤ v < 5.2.10, 5.3.0 ≤ v < 5.3.5, 6.0.0 | 4.9.10, 4.10.5, 5.2.10, 5.3.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.