OXID eShop Information Disclosure Vulnerability
BID:42662
Info
OXID eShop Information Disclosure Vulnerability
| Bugtraq ID: | 42662 |
| Class: | Design Error |
| CVE: |
CVE-2009-2266 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 11 2009 12:00AM |
| Updated: | Aug 11 2009 12:00AM |
| Credit: | OXID eSales AG |
| Vulnerable: |
OXID eSales AG OXID eShop Professional 4.0 0_13895 OXID eSales AG OXID eShop Professional 4.1.3-19918 OXID eSales AG OXID eShop Professional 4.1.2 18998 OXID eSales AG OXID eShop Professional 4.1.1-18442 OXID eSales AG OXID eShop Professional 4.1.0 17976 OXID eSales AG OXID eShop Professional 4.0.1.0_15990 OXID eSales AG OXID eShop Professional 4.0.0.2_14842 OXID eSales AG OXID eShop Professional 4.0.0.1_14455 OXID eSales AG OXID eShop Professional 4.0.0.0_14260 OXID eSales AG OXID eShop Professional 4.0.0 0_13934 OXID eSales AG OXID eShop Enterprise 4.1.3-19918 OXID eSales AG OXID eShop Enterprise 4.1.2 18998 OXID eSales AG OXID eShop Enterprise 4.1.1-18442 OXID eSales AG OXID eShop Enterprise 4.1.0 17976 OXID eSales AG OXID eShop Enterprise 4.0.1.0_15990 OXID eSales AG OXID eShop Enterprise 4.0.0.2_14967 OXID eSales AG OXID eShop Enterprise 4.0.0.2_14842 OXID eSales AG OXID eShop Enterprise 4.0.0.1_14455 OXID eSales AG OXID eShop Enterprise 4.0.0.0_14260 OXID eSales AG OXID eShop Enterprise 4.0.0 0_13934 OXID eSales AG OXID eShop Enterprise 4.0.0 0_13895 OXID eSales AG OXID eShop Community 4.1.3-19918 OXID eSales AG OXID eShop Community 4.1.2 18998 OXID eSales AG OXID eShop Community 4.1.1-18442 OXID eSales AG OXID eShop Community 4.1.1 OXID eSales AG OXID eShop Community 4.1.0 17976 OXID eSales AG OXID eShop Community 4.0.1.0_15990 OXID eSales AG OXID eShop Community 4.0.0.2_14967 OXID eSales AG OXID eShop Community 4.0.0.2_14842 OXID eSales AG OXID eShop Community 4.0.0.1_14455 OXID eSales AG OXID eShop Community 4.0.0.0_14260 OXID eSales AG OXID eShop Community 4.0.0 0_13934 OXID eSales AG OXID eShop Community 4.0.0 0_13895 |
| Not Vulnerable: |
OXID eSales AG OXID eShop Professional 4.1.4 21266 OXID eSales AG OXID eShop Enterprise 4.1.4 21266 OXID eSales AG OXID eShop Community 4.1.4 21266 |
Discussion
OXID eShop Information Disclosure Vulnerability
OXID eShop is prone to a remote information-disclosure vulnerability.
Successful exploits will allow attackers to gain access to the session information of unregistered users. This may lead to further attacks.
Versions prior to OXID eShop Professional, Community, and Enterprise 4.1.4-21266 are vulnerable.
OXID eShop is prone to a remote information-disclosure vulnerability.
Successful exploits will allow attackers to gain access to the session information of unregistered users. This may lead to further attacks.
Versions prior to OXID eShop Professional, Community, and Enterprise 4.1.4-21266 are vulnerable.
Exploit / POC
OXID eShop Information Disclosure Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
OXID eShop Information Disclosure Vulnerability
Solution:
Updates are available. Please see the references for details.
Solution:
Updates are available. Please see the references for details.
References
OXID eShop Information Disclosure Vulnerability
References:
References:
- OXID eSales AG Security Bulletin 2009-003 (OXID eSales AG)
- OXID eShop Homepage (OXID eSales AG)