GHSA-qqcr-9jfc-35c4

OXID eShop May Display User Information

Source: GitHub Advisory Database (reviewed) High CVE-2024-56526

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	oxid-esales/oxideshop-ce	>= 6.0.0, < 6.14.4	6.14.4
Packagist	oxid-esales/oxideshop-metapackage-ce	>= 6.0.0, < 6.5.5	6.5.5
Packagist	oxid-esales/smarty-component	< 1.0.1	1.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in OXID eShop before 7. CMS pages in combination with Smarty may display user information if a CMS page contains a Smarty syntax error.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-56526 advisory
https://bugs.oxid-esales.com/view.php?id=7743 web
https://github.com/OXID-eSales/oxideshop_ce package
https://github.com/OXID-eSales/oxideshop_ce/releases/tag/v6.14.4 web
https://github.com/OXID-eSales/oxideshop_metapackage_ce/releases/tag/v6.5.5 web