CVE-2018-12579

Опубликовано: 20 авг. 2018

Источник: nvd

CVSS3: 8.1

CVSS2: 6.8

EPSS Низкий

Описание

An issue was discovered in OXID eShop Enterprise Edition before 5.3.8, 6.0.x before 6.0.3, and 6.1.x before 6.1.0; Professional Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0; and Community Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0. An attacker could gain access to the admin panel or a customer account when using the password reset function. To do so, it is required to own a domain name similar to the one the victim uses for their e-mail accounts.

Ссылки

https://bugs.oxid-esales.com/view.php?id=6818
Vendor Advisory
https://oxidforge.org/en/security-bulletin-2018-002.html
Patch
Third Party Advisory
https://bugs.oxid-esales.com/view.php?id=6818
Vendor Advisory
https://oxidforge.org/en/security-bulletin-2018-002.html
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:oxid-esales:eshop:*:*:*:*:community:*:*:*

Версия до 4.10.7 (включая)

cpe:2.3:a:oxid-esales:eshop:*:*:*:*:professional:*:*:*

Версия до 4.10.7 (включая)

cpe:2.3:a:oxid-esales:eshop:*:*:*:*:enterprise:*:*:*

Версия до 5.3.7 (включая)

cpe:2.3:a:oxid-esales:eshop:6.0.0:beta1:*:*:community:*:*:*

cpe:2.3:a:oxid-esales:eshop:6.0.0:beta1:*:*:enterprise:*:*:*

cpe:2.3:a:oxid-esales:eshop:6.0.0:beta1:*:*:professional:*:*:*

cpe:2.3:a:oxid-esales:eshop:6.0.0:beta2:*:*:community:*:*:*

cpe:2.3:a:oxid-esales:eshop:6.0.0:beta2:*:*:enterprise:*:*:*

cpe:2.3:a:oxid-esales:eshop:6.0.0:beta2:*:*:professional:*:*:*

cpe:2.3:a:oxid-esales:eshop:6.0.0:beta3:*:*:community:*:*:*

cpe:2.3:a:oxid-esales:eshop:6.0.0:beta3:*:*:enterprise:*:*:*

cpe:2.3:a:oxid-esales:eshop:6.0.0:beta3:*:*:professional:*:*:*

cpe:2.3:a:oxid-esales:eshop:6.0.0:rc1:*:*:community:*:*:*

cpe:2.3:a:oxid-esales:eshop:6.0.0:rc1:*:*:enterprise:*:*:*

cpe:2.3:a:oxid-esales:eshop:6.0.0:rc1:*:*:professional:*:*:*

cpe:2.3:a:oxid-esales:eshop:6.0.0:rc2:*:*:community:*:*:*

cpe:2.3:a:oxid-esales:eshop:6.0.0:rc2:*:*:enterprise:*:*:*

cpe:2.3:a:oxid-esales:eshop:6.0.0:rc2:*:*:professional:*:*:*

cpe:2.3:a:oxid-esales:eshop:6.0.2:*:*:*:community:*:*:*

cpe:2.3:a:oxid-esales:eshop:6.0.2:*:*:*:enterprise:*:*:*

cpe:2.3:a:oxid-esales:eshop:6.0.2:*:*:*:professional:*:*:*

EPSS

Процентиль: 61%

0.0042

Низкий

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-640

Связанные уязвимости

GHSA-xpxq-36mx-cwhx