HIGH7.5
GHSA-qqcr-9jfc-35c4
OXID eShop May Display User Information
Quick fix
GHSA-qqcr-9jfc-35c4 — oxid-esales/oxideshop-ce: upgrade to the fixed version with the command below.
composer require oxid-esales/oxideshop-ce:^6.14.4Details
An issue was discovered in OXID eShop before 7. CMS pages in combination with Smarty may display user information if a CMS page contains a Smarty syntax error.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/oxid-esales/oxideshop-ce
Introduced in:
6.0.0Fixed in: 6.14.4Fix
composer require oxid-esales/oxideshop-ce:^6.14.4Packagist/oxid-esales/oxideshop-metapackage-ce
Introduced in:
6.0.0Fixed in: 6.5.5Fix
composer require oxid-esales/oxideshop-metapackage-ce:^6.5.5Packagist/oxid-esales/smarty-component
Introduced in:
0Fixed in: 1.0.1Fix
composer require oxid-esales/smarty-component:^1.0.1References
- https://nvd.nist.gov/vuln/detail/CVE-2024-56526[ADVISORY]
- https://bugs.oxid-esales.com/view.php?id=7743[WEB]
- https://github.com/OXID-eSales/oxideshop_ce[PACKAGE]
- https://github.com/OXID-eSales/oxideshop_ce/releases/tag/v6.14.4[WEB]
- https://github.com/OXID-eSales/oxideshop_metapackage_ce/releases/tag/v6.5.5[WEB]