← Back

CVE-2009-2266

nvd nist
Published: Sep 9, 2009Modified: Apr 23, 2026

JSON object

Loading...
5.0
Vector
AV:N/AC:L/Au:N/C:P/I:N/A:N
Exploitability: 10.0 / Impact: 2.9
Source: NVD

Description

OXID eShop 4.x before 4.1.4-21266, 3.x, and 2.x allows remote attackers to obtain sensitive information (session details and order history of other users) via a crafted cookie.

Affected (33)

Products: Oxid: Eshop
Oxid
1 product
Eshop
Configuration A
33 vulnerable
Vulnerable SoftwareAffected Versions
Oxid
Eshop
Up to 2.7.0.3
Eshop
Up to 3.0.4.1
Eshop
Version 4.0.0.0_13895
Eshop
Version 4.0.0.0_13895
Eshop
Version 4.0.0.0_13895
Eshop
Version 4.0.0.0_13934
Eshop
Version 4.0.0.0_13934
Eshop
Version 4.0.0.0_13934
Eshop
Version 4.0.0.0_14260
Eshop
Version 4.0.0.0_14260
Eshop
Version 4.0.0.0_14260
Eshop
Version 4.0.0.1_14455
Eshop
Version 4.0.0.1_14455
Eshop
Version 4.0.0.1_14455
Eshop
Version 4.0.0.2_14842
Eshop
Version 4.0.0.2_14842
Eshop
Version 4.0.0.2_14842
Eshop
Version 4.0.0.2_14967
Eshop
Version 4.0.0.2_14967
Eshop
Version 4.0.0.2_14967
Eshop
Version 4.0.1.0_15990
Eshop
Version 4.0.1.0_15990
Eshop
Version 4.0.1.0_15990
Eshop
Version 4.1.0-17976
Eshop
Version 4.1.0-17976
Eshop
Version 4.1.0-17976
Eshop
Version 4.1.1-18442
Eshop
Version 4.1.2-18998
Eshop
Version 4.1.2-18998
Eshop
Version 4.1.2-18998
Eshop
Version 4.1.3-19918
Eshop
Version 4.1.3-19918
Eshop
Version 4.1.3-19918

Related CWEs

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

Source: cve@mitre.org
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.