HIGH 7.5
GHSA-qqcr-9jfc-35c4
OXID eShop May Display User Information
Quick fix
GHSA-qqcr-9jfc-35c4 — oxid-esales/oxideshop-ce: upgrade to the fixed version with the command below.
composer require oxid-esales/oxideshop-ce:^6.14.4Details
An issue was discovered in OXID eShop before 7. CMS pages in combination with Smarty may display user information if a CMS page contains a Smarty syntax error.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist / oxid-esales/oxideshop-ce
Introduced in:
6.0.0 Fixed in: 6.14.4 Fix
composer require oxid-esales/oxideshop-ce:^6.14.4 Packagist / oxid-esales/oxideshop-metapackage-ce
Introduced in:
6.0.0 Fixed in: 6.5.5 Fix
composer require oxid-esales/oxideshop-metapackage-ce:^6.5.5 Packagist / oxid-esales/smarty-component
Introduced in:
0 Fixed in: 1.0.1 Fix
composer require oxid-esales/smarty-component:^1.0.1 References
- https://nvd.nist.gov/vuln/detail/CVE-2024-56526 [ADVISORY]
- https://bugs.oxid-esales.com/view.php?id=7743 [WEB]
- https://github.com/OXID-eSales/oxideshop_ce [PACKAGE]
- https://github.com/OXID-eSales/oxideshop_ce/releases/tag/v6.14.4 [WEB]
- https://github.com/OXID-eSales/oxideshop_metapackage_ce/releases/tag/v6.5.5 [WEB]