NVD Vulnerability Detail

CVE-2017-14993

Summary	OXID eShop Community Edition before 6.0.0 RC3 (development), 4.10.x before 4.10.6 (maintenance), and 4.9.x before 4.9.11 (legacy), Enterprise Edition before 6.0.0 RC3 (development), 5.2.x before 5.2.11 (legacy), and 5.3.x before 5.3.6 (maintenance), and Professional Edition before 6.0.0 RC3 (development), 4.9.x before 4.9.11 (legacy) and 4.10.x before 4.10.6 (maintenance) allow remote attackers to crawl specially crafted URLs (aka "forced browsing") in order to overflow the database of the shop and consequently make it stop working. Prerequisite: the shop allows rendering empty categories to the storefront via an admin option.
Publication Date	Feb. 21, 2018, 8:29 a.m.
Registration Date	Jan. 26, 2021, 1:16 p.m.
Last Update	Nov. 21, 2024, 12:13 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:oxid-esales:eshop:6.0.0:rc1:::community:::*
cpe:2.3:a:oxid-esales:eshop:6.0.0:rc1:::professional:::*
cpe:2.3:a:oxid-esales:eshop:6.0.0:rc1:::enterprise:::*
cpe:2.3:a:oxid-esales:eshop:6.0.0:rc2:::enterprise:::*
cpe:2.3:a:oxid-esales:eshop:::::enterprise:::*	5.3.0			5.3.6
cpe:2.3:a:oxid-esales:eshop:::::enterprise:::*	5.2.0			5.2.11
cpe:2.3:a:oxid-esales:eshop:6.0.0:rc2:::professional:::*
cpe:2.3:a:oxid-esales:eshop:::::professional:::*	4.9.0			4.9.11
cpe:2.3:a:oxid-esales:eshop:::::professional:::*	4.10.0			4.10.6
cpe:2.3:a:oxid-esales:eshop:6.0.0:rc2:::community:::*
cpe:2.3:a:oxid-esales:eshop:::::community:::*	4.10.0			4.10.6
cpe:2.3:a:oxid-esales:eshop:::::community:::*	4.9.0			4.9.11

Related information, measures and tools

No	URL	タグ
1	https://bugs.oxid-esales.com/view.php?id=6678	Vendor Advisory
2	https://bugs.oxid-esales.com/view.php?id=6678	Vendor Advisory
3	https://oxidforge.org/en/security-bulletin-2017-002.html	Patch Vendor Advisory
4	https://oxidforge.org/en/security-bulletin-2017-002.html	Patch Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-425	リクエストの直接送信	https://cwe.mitre.org/data/definitions/425.html

JVN Vulnerability Information

OXID eShop におけるリソース管理に関する脆弱性

Title	OXID eShop におけるリソース管理に関する脆弱性
Summary	OXID eShop には、リソース管理に関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Nov. 2, 2017, midnight
Registration Date	April 13, 2018, 4:43 p.m.
Last Update	April 13, 2018, 4:43 p.m.

Affected System

OXID eSales AG

OXID eShop

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-14993	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14993
National Vulnerability Database (NVD)
2	CVE-2017-14993	https://nvd.nist.gov/vuln/detail/CVE-2017-14993

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-399	https://jvndb.jvn.jp/ja/cwe/CWE-399.html

ベンダー情報

No	Name	URL
OXID
1	Security Bulletin 2017-002	https://oxidforge.org/en/security-bulletin-2017-002.html
OXID eShop bugtrack
2	0006678	https://bugs.oxid-esales.com/view.php?id=6678

Change Log

No	Changed Details	Date of change
1	[2018年04月13日] 掲載	April 13, 2018, 4:43 p.m.