GitHub Advisoryadvisory · Packagist
GHSA-qqcr-9jfc-35c4 OXID eShop May Display User Information
HIGH
Official page ↗
- Aliases
- CVE-2024-56526
- Ecosystem
- Packagist
- Packages
- oxid-esales/oxideshop-ce, oxid-esales/oxideshop-metapackage-ce, oxid-esales/smarty-component
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-200
- Reviewed
- 2025-05-14
Affected packages
• Packagist oxid-esales/oxideshop-ce: >= 6.0.0, < 6.14.4 → fixed in 6.14.4
• Packagist oxid-esales/oxideshop-metapackage-ce: >= 6.0.0, < 6.5.5 → fixed in 6.5.5
• Packagist oxid-esales/smarty-component: < 1.0.1 → fixed in 1.0.1
Description
An issue was discovered in OXID eShop before 7. CMS pages in combination with Smarty may display user information if a CMS page contains a Smarty syntax error.
Related
Alias · CVE (1)
- CVE-2024-56526 An issue was discovered in OXID eShop before 7. vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-56526 advisory
- https://bugs.oxid-esales.com/view.php?id=7743 web
- https://github.com/OXID-eSales/oxideshop_ce package
- https://github.com/OXID-eSales/oxideshop_ce/releases/tag/v6.14.4 web
- https://github.com/OXID-eSales/oxideshop_metapackage_ce/releases/tag/v6.5.5 web