Lucene search
HistoryAug 02, 2023 - 3:15 p.m.
CVE-2023-38330
cve-2023-38330
oxid eshop
file upload
http response splitting
CVSS3
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
AI Score
5.3
Confidence
High
EPSS
0.001
Percentile
30.6%
OXID eShop Enterprise Edition 6.5.0 – 6.5.2 before 6.5.3 allows uploading files with modified headers in the administration area. An attacker can upload a file with a modified header to create a HTTP Response Splitting attack.
Affected configurations
Node
oxid-esaleseshopRange6.5.0–6.5.3enterprise
| Vendor | Product | Version | CPE |
|---|---|---|---|
| oxid-esales | eshop | * | cpe:2.3:a:oxid-esales:eshop:*:*:*:*:enterprise:*:*:* |
Related
prion
prion
Design/Logic Flaw
2023-08-02 15:15:00
cve
cve
CVE-2023-38330
2023-08-02 15:15:10
cvelist
cvelist
CVE-2023-38330
2023-08-02 00:00:00
CVSS3
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
AI Score
5.3
Confidence
High
EPSS
0.001
Percentile
30.6%
Related for NVD:CVE-2023-38330