CVE-2015-6926

HIGH

OXID eShop < 4.5.0 - Improper Authentication via OpenID Email Address Spoofing

Title source: llm

Description

The OpenID Single Sign-On authentication functionality in OXID eShop before 4.5.0 allows remote attackers to impersonate users via the email address in a crafted authentication token.

References (2)

Core 2

Core References

Mitigation, Vendor Advisory x_refsource_confirm

https://oxidforge.org/en/oxid-security-bulletin-2015-001.html

Issue Tracking, Vendor Advisory x_refsource_confirm

https://bugs.oxid-esales.com/view.php?id=6224

Scores

CVSS v3 7.5

EPSS 0.0108

EPSS Percentile 60.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE

CWE-287

Status published

Products (2)

oxid-esales/eshop 4.0.1.0 - 4.4.8 (3 CPE variants)

oxid-esales/oxideshop-ce 0 - 4.5.0Packagist

Published Jan 19, 2018

Tracked Since Feb 18, 2026