Vulnerability Details : CVE-2019-17062
An issue was discovered in OXID eShop 6.x before 6.0.6 and 6.1.x before 6.1.5, OXID eShop Enterprise Edition Version 5.2.x-5.3.x, OXID eShop Professional Edition Version 4.9.x-4.10.x and OXID eShop Community Edition Version: 4.9.x-4.10.x. By using a specially crafted URL, users with administrative rights could unintentionally grant unauthorized users access to the admin panel via session fixation.
Exploit prediction scoring system (EPSS) score for CVE-2019-17062
Probability of exploitation activity in the next 30 days: 0.22%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 59 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2019-17062
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2019-17062
-
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-17062
-
https://oxidforge.org/en/security-bulletin-2019-002.html
Security Bulletin 2019-002 • OXIDforgeVendor Advisory
Products affected by CVE-2019-17062
- Oxid-esales » Eshop » Enterprise EditionVersions from including (>=) 5.2.0 and up to, including, (<=) 5.3.0cpe:2.3:a:oxid-esales:eshop:*:*:*:*:enterprise:*:*:*
- Oxid-esales » Eshop » Community EditionVersions from including (>=) 4.9.0 and up to, including, (<=) 4.10.0cpe:2.3:a:oxid-esales:eshop:*:*:*:*:community:*:*:*
- cpe:2.3:a:oxid-esales:eshop:*:*:*:*:enterprise:*:*:*
- cpe:2.3:a:oxid-esales:eshop:*:*:*:*:community:*:*:*
- cpe:2.3:a:oxid-esales:eshop:*:*:*:*:professional:*:*:*
- cpe:2.3:a:oxid-esales:eshop:*:*:*:*:enterprise:*:*:*
- cpe:2.3:a:oxid-esales:eshop:*:*:*:*:community:*:*:*
- Oxid-esales » Eshop » Professional EditionVersions from including (>=) 4.9.0 and up to, including, (<=) 4.10.0cpe:2.3:a:oxid-esales:eshop:*:*:*:*:professional:*:*:*
- cpe:2.3:a:oxid-esales:eshop:*:*:*:*:professional:*:*:*