CVE-2017-14993
Last modified
CVE-2017-14993 is a vulnerability of currently unknown severity. OXID eShop Community Edition before 6.0.0 RC3 (development), 4.10.x before 4.10.6 (maintenance), and 4.9.x before 4.9.11 (legacy), Enterprise Edition before 6.0.0 RC3 (development), 5.2.x before 5.2.11 (legacy), and 5.3.x before 5.3.6 (maintenance), and Professional Edition before 6.0.0 RC3 (development), 4.9.x before 4.9.11 (legacy) and 4.10.x before 4.10.6 (maintenance) allow remote attackers to crawl specially crafted URLs (aka "forced browsing") in order to overflow the database of the shop and consequently make it stop working. Prerequisite: the shop allows rendering empty categories to the storefront via an admin option.. EPSS estimates a 1.23% chance of exploitation in the next 30 days.
Description
OXID eShop Community Edition before 6.0.0 RC3 (development), 4.10.x before 4.10.6 (maintenance), and 4.9.x before 4.9.11 (legacy), Enterprise Edition before 6.0.0 RC3 (development), 5.2.x before 5.2.11 (legacy), and 5.3.x before 5.3.6 (maintenance), and Professional Edition before 6.0.0 RC3 (development), 4.9.x before 4.9.11 (legacy) and 4.10.x before 4.10.6 (maintenance) allow remote attackers to crawl specially crafted URLs (aka "forced browsing") in order to overflow the database of the shop and consequently make it stop working. Prerequisite: the shop allows rendering empty categories to the storefront via an admin option.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Oxid-Esales | Eshop | >= 4.9.0, < 4.9.11 | — |
| Oxid-Esales | Eshop | >= 4.10.0, < 4.10.6 | — |
| Oxid-Esales | Eshop | >= 5.2.0, < 5.2.11 | — |
| Oxid-Esales | Eshop | >= 5.3.0, < 5.3.6 | — |
| Oxid-Esales | Eshop | 6.0.0 | Rc1 |
References
- https://bugs.oxid-esales.com/view.php?id=6678Vendor Advisory
- https://oxidforge.org/en/security-bulletin-2017-002.htmlPatch, Vendor Advisory
- https://bugs.oxid-esales.com/view.php?id=6678Vendor Advisory
- https://oxidforge.org/en/security-bulletin-2017-002.htmlPatch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-14993?
How severe is CVE-2017-14993?
How do I fix CVE-2017-14993?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-14988Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 al…
- CVE-2017-14989A use-after-free in RenderFreetype in MagickCore/annotate.c …
- CVE-2017-1499IBM Maximo Asset Management 7.5 and 7.6 could allow a remote…
- CVE-2017-14990WordPress 4.8.2 stores cleartext wp_signups.activation_key v…
- CVE-2017-14991The sg_ioctl function in drivers/scsi/sg.c in the Linux kern…
- CVE-2017-14992Lack of content verification in Docker-CE (Also known as Mob…
- CVE-2017-14994ReadDCMImage in coders/dcm.c in GraphicsMagick 1.3.26 allows…
- CVE-2017-14995The Management Console in WSO2 Application Server 5.3.0, WSO…
- CVE-2017-14997GraphicsMagick 1.3.26 allows remote attackers to cause a den…
- CVE-2017-1500A Reflected Cross Site Scripting (XSS) vulnerability exists …
- CVE-2017-15008PRTG Network Monitor version 17.3.33.2830 is vulnerable to s…
- CVE-2017-15009PRTG Network Monitor version 17.3.33.2830 is vulnerable to r…
Are you affected by CVE-2017-14993?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST