CVE-2019-17062

Published: Nov 5, 2019Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

An issue was discovered in OXID eShop 6.x before 6.0.6 and 6.1.x before 6.1.5, OXID eShop Enterprise Edition Version 5.2.x-5.3.x, OXID eShop Professional Edition Version 4.9.x-4.10.x and OXID eShop Community Edition Version: 4.9.x-4.10.x. By using a specially crafted URL, users with administrative rights could unintentionally grant unauthorized users access to the admin panel via session fixation.

Affected (9)

Products: Oxid Esales: Eshop

Oxid Esales

1 product

Eshop

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Oxid Esales Eshop	4.9.0 ≤ version ≤ 4.10.0
Oxid Esales Eshop	6.0.0 ≤ version < 6.0.6
Oxid Esales Eshop	6.1.0 ≤ version < 6.1.5
Oxid Esales Eshop	5.2.0 ≤ version ≤ 5.3.0
Oxid Esales Eshop	6.0.0 ≤ version < 6.0.6
Oxid Esales Eshop	6.1.0 ≤ version < 6.1.5
Oxid Esales Eshop	4.9.0 ≤ version ≤ 4.10.0
Oxid Esales Eshop	6.0.0 ≤ version < 6.0.6
Oxid Esales Eshop	6.1.0 ≤ version < 6.1.5