Security Bulletin 2017-001 • OXIDforge

CVE Identifier: CVE-2017-12415
CVSS Score: 2.2
Release Date: 2017-08-16

The following vulnerability has been identified:

Synopsis

Under certain pre-conditions an attacker would be able to hijack the cart session of a client via a Cross-Site Request Forgery (CSRF).

State

until now, no 0-day exploit is known
resolved, patch releases available

Impact

An attacker could alter a shop customer’s cart content if the following pre-conditions are met:

An attacker knows which shop is presently used by the client.
An attacker knows the exact time when the customer will add product items to the cart.
An attacker knows which product items are already in the cart (has to know their article IDs).
An attacker would be able to trick user into clicking a button (submit form) of an e-mail or remote site within the period of visiting the shop and placing an order.

Affected products, releases and platforms

Products:

OXID eShop Enterprise Edition (“EE”)
OXID eShop Professional Edition (“PE”)
OXID eShop Community Edition (“CE”)

Releases:

All OXID eShop versions up to 5.3.x (EE) and 4.10.x (PE, CE)
All OXID eShop v6 (beta and RC1 versions)

Platforms:

All releases are affected on all platforms

Resolution

The issue has already been resolved in the following releases:

OXID eShop Enterprise Edition v5.2.10
OXID eShop Enterprise Edition v5.3.5
OXID eShop Enterprise Edition v6.0.0 RC2 (not released yet)
OXID eShop Professional Edition v4.9.10
OXID eShop Professional Edition v4.10.5
OXID eShop Professional Edition v6.0.0 RC2 (not released yet)
OXID eShop Community Edition v4.9.10
OXID eShop Community Edition v4.10.5
OXID eShop Community Edition v6.0.0 RC2 (not released yet)

Bug tracker entry (in private state until August 16th): https://bugs.oxid-esales.com/view.php?id=6674

Workarounds

As the severity and the potential of data loss or harm is very low, we will not provide a workaround.
Please note that a fix for end-of-life versions will not be provided. Please update your OXID eShop installation.

Credits

Thanks a lot to the ifixit security team, who got this information from a security researcher, validated it and immediately reported it to us.

Stay up-to-date

To receive upcoming OXID Security Bulletins, please subscribe to the RSS feed: http://oxidforge.org/en/shop/development-security/feed.

How to report security issues

Learn how to report security issues in the Security overview page.