Lucene search

MitreCVE-2019-17062

HistoryNov 05, 2019 - 4:15 p.m.

CVE-2019-17062

2019-11-0516:15:10

CWE-384

mitre

web.nvd.nist.gov

cve-2019-17062

oxid eshop

unauthorized access

session fixation

security vulnerability

nvd

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

High

EPSS

0.002

Percentile

60.1%

JSON

An issue was discovered in OXID eShop 6.x before 6.0.6 and 6.1.x before 6.1.5, OXID eShop Enterprise Edition Version 5.2.x-5.3.x, OXID eShop Professional Edition Version 4.9.x-4.10.x and OXID eShop Community Edition Version: 4.9.x-4.10.x. By using a specially crafted URL, users with administrative rights could unintentionally grant unauthorized users access to the admin panel via session fixation.

Affected configurations

Nvd

Node

oxid-esaleseshopRange4.9.0–4.10.0community

oxid-esaleseshopRange4.9.0–4.10.0professional

oxid-esaleseshopRange5.2.0–5.3.0enterprise

oxid-esaleseshopRange6.0.0–6.0.6community

oxid-esaleseshopRange6.0.0–6.0.6enterprise

oxid-esaleseshopRange6.0.0–6.0.6professional

oxid-esaleseshopRange6.1.0–6.1.5community

oxid-esaleseshopRange6.1.0–6.1.5enterprise

oxid-esaleseshopRange6.1.0–6.1.5professional

VendorProductVersionCPE
oxid-esaleseshop*cpe:2.3:a:oxid-esales:eshop:*:*:*:*:community:*:*:*
oxid-esaleseshop*cpe:2.3:a:oxid-esales:eshop:*:*:*:*:professional:*:*:*
oxid-esaleseshop*cpe:2.3:a:oxid-esales:eshop:*:*:*:*:enterprise:*:*:*

Vendor	Product	Version	CPE
oxid-esales	eshop	*	cpe:2.3:a:oxid-esales:eshop:::::community:::*
oxid-esales	eshop	*	cpe:2.3:a:oxid-esales:eshop:::::professional:::*
oxid-esales	eshop	*	cpe:2.3:a:oxid-esales:eshop:::::enterprise:::*

References

oxidforge.org/en/security-bulletin-2019-002.html

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

High

EPSS

0.002

Percentile

60.1%

JSON

Related for CVE-2019-17062