The following issue has been identified:
An XSS vulnerability was found.
- Resolved in OXID eShop version 4.7.11/5.0.11. and OXID eShop version 4.8.4/5.1.4.
- A fix for OXID eShop version 4.6.8 is available.
- Please see the proposed workaround for older Versions of OXID eShop.
Under certain circumstances, an attacker can trick a user to enter a specially crafted URI or click on a mal-formed link to exploit a cross-site scripting vulnerability that theoretically can be used to gain unauthorized access to a user account or collect sensitive information of this user.
No exploits are known as of today.
Affected products, releases and platforms
- OXID eShop Enterprise Edition
- OXID eShop Professional Edition
- OXID eShop Community Edition
- All previous releases
- All releases are affected on all platforms.
The issue has been addressed in the following patch releases (estimated on FEB 25th):
- OXID eShop Professional Edition version 4.7.11 and 4.8.4
- OXID eShop Enterprise Edition version 5.0.11 and 5.1.4
- OXID eShop Community Edition version 4.7.11 and 4.8.4
and as a fix for the following versions:
- OXID eShop Professional Edition version 4.6.8
- OXID eShop Enterprise Edition version 4.6.8
- OXID eShop Community Edition version 4.6.8
Bug tracker entry: https://bugs.oxid-esales.com/view.php?id=5611
1. Please find the public function getTag() around line 1019 in application/controllers/details.php (views/details.php in former versions).
Replace the line
return oxConfig::getParameter("searchtag", 1);
return oxConfig::getParameter("searchtag", false);
2. and the public function getTag() around line 252 in application/controllers/tag.php (views/tag.php in former versions).
Replace the line
$this->_sTag = oxConfig::getParameter("searchtag", 1);
$this->_sTag = oxConfig::getParameter("searchtag", false);
Many thanks to Heiko Frenzel for the hint!
To receive upcoming OXID Security Bulletins, please subscribe to the mailing lists or the Announcement forum
How to report security issues
Learn how to report security issues in the Security overview page.