Design/Logic Flaw

2018-01-1915:29:00

PRIOn knowledge base

www.prio-n.com

7.3 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

53.0%

JSON

OXID eShop Professional Edition before 4.7.13 and 4.8.x before 4.8.7, Enterprise Edition before 5.0.13 and 5.1.x before 5.1.7, and Community Edition before 4.7.13 and 4.8.x before 4.8.7 allow remote attackers to assign users to arbitrary dynamical user groups.

CPENameOperatorVersion
eshoplt4.7.13
eshopge4.8.0
eshoplt4.8.7
eshoplt5.0.13
eshopge5.1.0
eshoplt5.1.7
eshoplt4.7.13
eshopge4.8.0
eshoplt4.8.7

Name	Operator	Version
eshop	lt	4.7.13
eshop	ge	4.8.0
eshop	lt	4.8.7
eshop	lt	5.0.13
eshop	ge	5.1.0
eshop	lt	5.1.7
eshop	lt	4.7.13
eshop	ge	4.8.0
eshop	lt	4.8.7

References

bugs.oxid-esales.com/view.php?id=5814

oxidforge.org/en/security-bulletin-2014-003.html