Vulnerability Description
OXID eShop Enterprise Edition 6.5.0 – 6.5.2 before 6.5.3 allows uploading files with modified headers in the administration area. An attacker can upload a file with a modified header to create a HTTP Response Splitting attack.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Oxid-Esales | Eshop | >= 6.5.0, < 6.5.3 |
Related Weaknesses (CWE)
References
- https://bugs.oxid-esales.com/view.php?id=7479Vendor Advisory
- https://docs.oxid-esales.com/de/security/security-bulletins.html#security-bulletVendor Advisory
- https://bugs.oxid-esales.com/view.php?id=7479Vendor Advisory
- https://docs.oxid-esales.com/de/security/security-bulletins.html#security-bulletVendor Advisory
FAQ
What is CVE-2023-38330?
CVE-2023-38330 is a vulnerability with a CVSS score of 5.3 (MEDIUM). OXID eShop Enterprise Edition 6.5.0 – 6.5.2 before 6.5.3 allows uploading files with modified headers in the administration area. An attacker can upload a file with a modified header to create a HTTP ...
How severe is CVE-2023-38330?
CVE-2023-38330 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-38330?
Check the references section above for vendor advisories and patch information. Affected products include: Oxid-Esales Eshop.