5.9

CVE-2018-5763

An issue was discovered in OXID eShop Enterprise Edition before 5.3.7 and 6.x before 6.0.1. By entering specially crafted URLs, an attacker is able to bring the shop server to a standstill and hence, it stops working. This is only valid if OXID High Performance Option is activated and Varnish is used.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Oxid-esales ≫ Eshop SwEdition enterprise Version < 5.3.7
Oxid-esales ≫ Eshop Version 6.0.0 SwEdition enterprise
Oxid-esales ≫ Eshop Version 6.0.0 Update rc1 SwEdition enterprise
Oxid-esales ≫ Eshop Version 6.0.0 Update rc2 SwEdition enterprise
Oxid-esales ≫ Eshop Version 6.0.0 Update rc3 SwEdition enterprise
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.07% 0.614
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.9 2.2 3.6
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:N/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://oxidforge.org/en/security-bulletin-2018-001.html
Vendor Advisory
Mitigation