high7.5
CVE-2024-56526
OXID eShop May Display User Information
Impact
An issue was discovered in OXID eShop before 7. CMS pages in combination with Smarty may display user information if a CMS page contains a Smarty syntax error.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | oxid-esales/oxideshop-ce | >= 6.0.0, < 6.14.4 | 6.14.4 |
| composer | oxid-esales/oxideshop-metapackage-ce | >= 6.0.0, < 6.5.5 | 6.5.5 |
| composer | oxid-esales/smarty-component | < 1.0.1 | 1.0.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Oxid-Esales | Eshop | through 7.0.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://bugs.oxid-esales.com/view.php?id=7743
- https://github.com/advisories/GHSA-qqcr-9jfc-35c4
- https://nvd.nist.gov/vuln/detail/CVE-2024-56526
- https://github.com/OXID-eSales/oxideshop_ce/releases/tag/v6.14.4
- https://github.com/OXID-eSales/oxideshop_metapackage_ce/releases/tag/v6.5.5