CVE-2023-38330

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-38330
OXID eShop Enterprise Edition 6.5.0 – 6.5.2 before 6.5.3 allows uploading files with modified headers in the administration area. An attacker can upload a file with a modified header to create a HTTP Response Splitting attack.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://bugs.oxid-esales.com/view.php?id=7479 Vendor Advisory
https://docs.oxid-esales.com/de/security/security-bulletins.html#security-bulletin-2023-002 Vendor Advisory
https://bugs.oxid-esales.com/view.php?id=7479 Vendor Advisory
https://docs.oxid-esales.com/de/security/security-bulletins.html#security-bulletin-2023-002 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:oxid-esales:eshop:*:*:*:*:enterprise:*:*:*
History

21 Nov 2024, 08:13

Type Values Removed Values Added
References () https://bugs.oxid-esales.com/view.php?id=7479 - Vendor Advisory () https://bugs.oxid-esales.com/view.php?id=7479 - Vendor Advisory
References () https://docs.oxid-esales.com/de/security/security-bulletins.html#security-bulletin-2023-002 - Vendor Advisory () https://docs.oxid-esales.com/de/security/security-bulletins.html#security-bulletin-2023-002 - Vendor Advisory
Summary
  • (es) OXID eShop Enterprise Edition 6.5.0 - 6.5.2 antes de 6.5.3 permite subir archivos con cabeceras modificadas en el área de administración. Un atacante puede subir un archivo con una cabecera modificada para crear un ataque de separación de respuesta HTTP.
Information

Published : 2023-08-02 15:15

Updated : 2024-11-21 08:13

NVD link : CVE-2023-38330

Mitre link : CVE-2023-38330

CVE.ORG link : CVE-2023-38330

JSON object : View

Products Affected

oxid-esales

  • eshop
CWE
CWE-434

Unrestricted Upload of File with Dangerous Type