CVE-2015-6926: OXID eShop user impersonation vulnerability
Summary
CVE-2015-6926: OXID eShop user impersonation vulnerability. Affects oxid-esales/oxideshop-ce versions < 4.5.0. Fixed in 4.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OXID eShop is an open-source e-commerce platform that allows businesses to create and manage online stores. It provides various features such as product management, order processing, and customer management. The OpenID Single Sign-On authentication functionality in OXID eShop before version 4.5.0 is vulnerable to user impersonation. This vulnerability allows remote attackers to impersonate users by exploiting a crafted authentication token that contains a manipulated email address.
Vulnerability Detail
The vulnerability in OXID eShop allows attackers to impersonate users by manipulating the email address in an authentication token. By exploiting this vulnerability, remote attackers can gain unauthorized access to user accounts and perform actions on behalf of the targeted users. This can lead to various security risks, such as unauthorized data access, fraudulent transactions, and reputational damage to the affected e-commerce businesses. The vulnerability is rated as HIGH severity with a CVSS score of 7.5.
How To Fix
Minimum fixed version
4.5.0
This is the first release that contains the fix.
composer require oxid-esales/oxideshop-ce:4.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The OXID eShop user impersonation vulnerability (CVE-2015-6926) allows remote attackers to impersonate users by manipulating the email address in an authentication token. To mitigate this vulnerability, it is crucial to upgrade OXID eShop to version 4.5.0 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for oxid-esales/oxideshop-ce →
FAQ
This vulnerability allows attackers to impersonate users and gain unauthorized access to their accounts. It can lead to unauthorized data access, fraudulent transactions, and reputational damage to affected e-commerce businesses.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
No, the recommended solution is to upgrade OXID eShop to version 4.5.0 or later.
There are no known instances of this vulnerability being exploited in the wild. However, it is important to update OXID eShop to the latest version to mitigate the risk.
For more information about this vulnerability, you can refer to the CVE-2015-6926 advisory and the OXID eShop documentation.
Related vulnerabilities
Recent vulnerabilities recorded for oxid-esales/oxideshop-ce.
