GitHub Advisoryadvisory · Packagist

GHSA-4c39-hj99-5h2r OXID eShop user impersonation vulnerability

HIGH Published 2022-05-13 Modified 2023-12-07 Official page ↗
Aliases
CVE-2015-6926
Ecosystem
Packagist
Packages
oxid-esales/oxideshop-ce
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-287
Reviewed
2023-07-31

Affected packages

• Packagist oxid-esales/oxideshop-ce: < 4.5.0 → fixed in 4.5.0

Description

The OpenID Single Sign-On authentication functionality in OXID eShop before 4.5.0 allows remote attackers to impersonate users via the email address in a crafted authentication token.

Related

Alias · CVE (1)

  • CVE-2015-6926 The OpenID Single Sign-On authentication functionality in OXID eShop before 4.5.0 allows remote attackers to impersonate users via the… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References