Security Bulletin 2017-001

• CVE Identifier: CVE-2017-12415
• CVSS Score: 2.2
• Release Date: 2017-08-16

The following vulnerability has been identified:

Synopsis

Under certain pre-conditions an attacker would be able to hijack the cart session of a client via a Cross-Site Request Forgery (CSRF).

State

• until now, no 0-day exploit is known
• resolved, patch releases available

Impact

An attacker could alter a shop customer’s cart content if the following pre-conditions are met:

• An attacker knows which shop is presently used by the client.
• An attacker knows the exact time when the customer will add product items to the cart.
• An attacker knows which product items are already in the cart (has to know their article IDs).
• An attacker would be able to trick user into clicking a button (submit form) of an e-mail or remote site within the period of visiting the shop and placing an order.

Affected products, releases and platforms

Products:

• OXID eShop Enterprise Edition (“EE”)
• OXID eShop Professional Edition (“PE”)
• OXID eShop Community Edition (“CE”)

Releases:

• All OXID eShop versions up to 5.3.x (EE) and 4.10.x (PE, CE)
• All OXID eShop v6 (beta and RC1 versions)

Platforms:

• All releases are affected on all platforms

Resolution

The issue has already been resolved in the following releases:

• OXID eShop Enterprise Edition v5.2.10
• OXID eShop Enterprise Edition v5.3.5
• OXID eShop Enterprise Edition v6.0.0 RC2 (not released yet)
• OXID eShop Professional Edition v4.9.10
• OXID eShop Professional Edition v4.10.5
• OXID eShop Professional Edition v6.0.0 RC2 (not released yet)
• OXID eShop Community Edition v4.9.10
• OXID eShop Community Edition v4.10.5
• OXID eShop Community Edition v6.0.0 RC2 (not released yet)

Bug tracker entry (in private state until August 16th): https://bugs.oxid-esales.com/view.php?id=6674

Workarounds

As the severity and the potential of data loss or harm is very low, we will not provide a workaround.
Please note that a fix for end-of-life versions will not be provided. Please update your OXID eShop installation.

Credits

Thanks a lot to the ifixit security team, who got this information from a security researcher, validated it and immediately reported it to us.

Stay up-to-date

To receive upcoming OXID Security Bulletins, please subscribe to the RSS feed: http://oxidforge.org/en/shop/development-security/feed.

How to report security issues

Learn how to report security issues in the Security overview page.