CVE-2017-14993 - CVE House

Back to Database

Status published High CVE-2017-14993

OXID eShop Community Edition before 6.0.0 RC3 (development), 4.10.x before...

7.5 CVSS

Vulnerability Description

OXID eShop Community Edition before 6.0.0 RC3 (development), 4.10.x before 4.10.6 (maintenance), and 4.9.x before 4.9.11 (legacy), Enterprise Edition before 6.0.0 RC3 (development), 5.2.x before 5.2.11 (legacy), and 5.3.x before 5.3.6 (maintenance), and Professional Edition before 6.0.0 RC3 (development), 4.9.x before 4.9.11 (legacy) and 4.10.x before 4.10.6 (maintenance) allow remote attackers to crawl specially crafted URLs (aka "forced browsing") in order to overflow the database of the shop and consequently make it stop working. Prerequisite: the shop allows rendering empty categories to the storefront via an admin option.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-14993

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from oxid-esales

View All →

An issue was discovered in OXID eShop 6.x before 6.0.6...

OXID eShop 6.0.x before 6.0.5 and 6.1.x before 6.1.4 allows...

An issue was discovered in OXID eShop Enterprise Edition before...

The DB abstraction layer of OXID eSales 4.10.6 is vulnerable...

An issue was discovered in OXID eShop Enterprise Edition before...

Affected Vendor

oxid-esales

View all reports →

Affected Software

eshop

Vulnerable Versions:

4.9.0, 4.10.0, 5.2.0, 5.3.0, 6.0.0

Timeline

Official Publish: February 20th, 2018

Last Modified: August 5th, 2024

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.