Lucene search

[email protected]CVE-2013-5913

HistoryOct 15, 2013 - 3:55 p.m.

CVE-2013-5913

2013-10-1515:55:03

CWE-79

[email protected]

web.nvd.nist.gov

cve-2013-5913

xss

web security

recommlist.php

oxid eshop

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.9%

JSON

Cross-site scripting (XSS) vulnerability in the getRecommSearch function in recommlist.php in OXID eShop before 4.6.7, Professional and Community Edition 4.7.x before 4.7.8, and Enterprise Edition 5.x before 5.0.8 allows remote attackers to inject arbitrary web script or HTML via the searchrecomm parameter.

Affected configurations

NVD

Node

oxid-esaleseshopRange≤4.6.6

oxid-esaleseshopMatch4.6.0

oxid-esaleseshopMatch4.6.1

oxid-esaleseshopMatch4.6.2

oxid-esaleseshopMatch4.6.3

oxid-esaleseshopMatch4.6.4

oxid-esaleseshopMatch4.6.5

oxid-esaleseshopMatch4.7.0community

oxid-esaleseshopMatch4.7.0professional

oxid-esaleseshopMatch4.7.1community

oxid-esaleseshopMatch4.7.1professional

oxid-esaleseshopMatch4.7.2community

oxid-esaleseshopMatch4.7.2professional

oxid-esaleseshopMatch4.7.3community

oxid-esaleseshopMatch4.7.3professional

oxid-esaleseshopMatch4.7.4community

oxid-esaleseshopMatch4.7.4professional

oxid-esaleseshopMatch4.7.5community

oxid-esaleseshopMatch4.7.5professional

oxid-esaleseshopMatch4.7.6community

oxid-esaleseshopMatch4.7.6professional

oxid-esaleseshopMatch4.7.7community

oxid-esaleseshopMatch4.7.7professional

oxid-esaleseshopMatch5.0.0enterprise

oxid-esaleseshopMatch5.0.1enterprise

oxid-esaleseshopMatch5.0.2enterprise

oxid-esaleseshopMatch5.0.3enterprise

oxid-esaleseshopMatch5.0.4enterprise

oxid-esaleseshopMatch5.0.5enterprise

oxid-esaleseshopMatch5.0.6enterprise

oxid-esaleseshopMatch5.0.7enterprise

CPENameOperatorVersion
oxid-esales:eshopoxid-esales eshople4.6.6
oxid-esales:eshopoxid-esales eshopeq4.6.0
oxid-esales:eshopoxid-esales eshopeq4.6.1
oxid-esales:eshopoxid-esales eshopeq4.6.2
oxid-esales:eshopoxid-esales eshopeq4.6.3
oxid-esales:eshopoxid-esales eshopeq4.6.4
oxid-esales:eshopoxid-esales eshopeq4.6.5
oxid-esales:eshopoxid-esales eshopeq4.7.0
oxid-esales:eshopoxid-esales eshopeq4.7.1
oxid-esales:eshopoxid-esales eshopeq4.7.2

CPE	Name	Operator	Version
oxid-esales:eshop	oxid-esales eshop	le	4.6.6
oxid-esales:eshop	oxid-esales eshop	eq	4.6.0
oxid-esales:eshop	oxid-esales eshop	eq	4.6.1
oxid-esales:eshop	oxid-esales eshop	eq	4.6.2
oxid-esales:eshop	oxid-esales eshop	eq	4.6.3
oxid-esales:eshop	oxid-esales eshop	eq	4.6.4
oxid-esales:eshop	oxid-esales eshop	eq	4.6.5
oxid-esales:eshop	oxid-esales eshop	eq	4.7.0
oxid-esales:eshop	oxid-esales eshop	eq	4.7.1
oxid-esales:eshop	oxid-esales eshop	eq	4.7.2

Rows per page:

1-10 of 231

References

osvdb.org/98235

secunia.com/advisories/55193

wiki.oxidforge.org/Security_bulletins/2013-001

www.securityfocus.com/bid/62901

exchange.xforce.ibmcloud.com/vulnerabilities/87760

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.9%

JSON

Related for CVE-2013-5913

nvd1 prion1 cvelist1