CVE-2014-2016

2014-03-2518:21:48

CWE-79

mitre

web.nvd.nist.gov

cve-2014-2016

xss

oxid eshop

cross-site scripting

web script injection

html injection

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.001

Percentile

49.1%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in OXID eShop Professional and Community Edition 4.6.8 and earlier, 4.7.x before 4.7.11, and 4.8.x before 4.8.4, and Enterprise Edition 4.6.8 and earlier, 5.0.x before 5.0.11 and 5.1.x before 5.1.4 allow remote attackers to inject arbitrary web script or HTML via the searchtag parameter to the getTag function in (1) application/controllers/details.php or (2) application/controllers/tag.php.

Affected configurations

Nvd

Node

oxid-esaleseshopRange≤4.6.8community

oxid-esaleseshopRange4.7.0–4.7.11community

oxid-esaleseshopRange4.8.0–4.8.4community

Node

oxid-esaleseshopRange≤4.6.8enterprise

oxid-esaleseshopRange5.0.0–5.0.11enterprise

oxid-esaleseshopRange5.1.0–5.1.4enterprise

Node

oxid-esaleseshopRange≤4.6.8professional

oxid-esaleseshopRange4.7.0–4.7.11professional

oxid-esaleseshopRange4.8.0–4.8.4professional

VendorProductVersionCPE
oxid-esaleseshop*cpe:2.3:a:oxid-esales:eshop:*:*:*:*:community:*:*:*
oxid-esaleseshop*cpe:2.3:a:oxid-esales:eshop:*:*:*:*:enterprise:*:*:*
oxid-esaleseshop*cpe:2.3:a:oxid-esales:eshop:*:*:*:*:professional:*:*:*

Vendor	Product	Version	CPE
oxid-esales	eshop	*	cpe:2.3:a:oxid-esales:eshop:::::community:::*
oxid-esales	eshop	*	cpe:2.3:a:oxid-esales:eshop:::::enterprise:::*
oxid-esales	eshop	*	cpe:2.3:a:oxid-esales:eshop:::::professional:::*