Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-12415

OXID eShop Community Edition before 6.0.0 RC2 (development), 4.10.x before 4.10.5 (maintenance), and 4.9.x before 4.9.10 (legacy), Enterprise Edition before 6.0.0 RC2 (development), 5.2.x before 5.2.10 (legacy), and 5.3.x before 5.3.5 (maintenance), and Professional Edition before 6.0.0 RC2 (development), 4.9.x before 4.9.10 (legacy) and 4.10.x before 4.10.5 (maintenance) allow remote attackers to hijack the cart session of a client via Cross-Site Request Forgery (CSRF) if the following pre-conditions are met: (1) the attacker knows which shop is presently used by the client, (2) the attacker knows the exact time when the customer will add product items to the cart, (3) the attacker knows which product items are already in the cart (has to know their article IDs), and (4) the attacker would be able to trick user into clicking a button (submit form) of an e-mail or remote site within the period of visiting the shop and placing an order.

Published

2018-02-20T23:29:00.247

Last Modified

2024-11-21T03:09:26.040

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: HIGH
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

4.9

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-352
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application oxid-esales eshop < 4.9.10 Yes
Application oxid-esales eshop < 4.9.10 Yes
Application oxid-esales eshop < 4.10.5 Yes
Application oxid-esales eshop < 4.10.5 Yes
Application oxid-esales eshop < 5.2.10 Yes
Application oxid-esales eshop < 5.3.5 Yes
Application oxid-esales eshop 6.0.0 Yes
Application oxid-esales eshop 6.0.0 Yes
Application oxid-esales eshop 6.0.0 Yes
References