OXID eShop 'sample-name.html' Cross Site Scripting Vulnerability

Bugtraq ID:	66372
Class:	Input Validation Error
CVE:	CVE-2014-2016
Remote:	Yes
Local:	No
Published:	Mar 20 2014 12:00AM
Updated:	Mar 20 2014 12:00AM
Credit:	Heiko Frenzel
Vulnerable:	OXID eSales AG OXID eShop Professional 4.7.7 OXID eSales AG OXID eShop Professional 4.3 OXID eSales AG OXID eShop Professional 4.1.2 OXID eSales AG OXID eShop Professional 4.1.1 OXID eSales AG OXID eShop Professional 4.1 OXID eSales AG OXID eShop Professional 4.2.0 OXID eSales AG OXID eShop Professional 4.1.6 OXID eSales AG OXID eShop Professional 4.1.5 OXID eSales AG OXID eShop Professional 4.1.4 OXID eSales AG OXID eShop Professional 4.1.3 OXID eSales AG OXID eShop Enterprise 5.0.7 OXID eSales AG OXID eShop Enterprise 4.3 OXID eSales AG OXID eShop Enterprise 4.2 OXID eSales AG OXID eShop Enterprise 4.1.6 OXID eSales AG OXID eShop Enterprise 4.1.5 OXID eSales AG OXID eShop Enterprise 4.1.4 OXID eSales AG OXID eShop Enterprise 4.1.3 OXID eSales AG OXID eShop Enterprise 4.1.2 OXID eSales AG OXID eShop Enterprise 4.1.1 OXID eSales AG OXID eShop Enterprise 4.1.0 OXID eSales AG OXID eShop Community 4.7.7 OXID eSales AG OXID eShop Community 4.3 OXID eSales AG OXID eShop Community 4.2 OXID eSales AG OXID eShop Community 4.1.6 OXID eSales AG OXID eShop Community 4.1.5 OXID eSales AG OXID eShop Community 4.1.4 OXID eSales AG OXID eShop Community 4.1 OXID eSales AG OXID eShop Community 4.1.3 OXID eSales AG OXID eShop Community 4.1.2 OXID eSales AG OXID eShop Community 4.1.1
Not Vulnerable:	OXID eSales AG OXID eShop Professional 4.8.4 OXID eSales AG OXID eShop Professional 4.7.11 OXID eSales AG OXID eShop Enterprise 5.1.4 OXID eSales AG OXID eShop Enterprise 5.0.11 OXID eSales AG OXID eShop Community 4.8.4 OXID eSales AG OXID eShop Community 4.7.11

OXID eShop 'sample-name.html' Cross Site Scripting Vulnerability

OXID eShop is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

OXID eShop 'sample-name.html' Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

OXID eShop 'sample-name.html' Cross Site Scripting Vulnerability

References:

• OXID eShop Homepage (OXID eSales AG)
  
• Security bulletins/2014-001 (OXID eShop)