OXID eShop 4.x before 4.1.4-21266, 3.x, and 2.x allows remote attackers to obtain…
Priority LOW 25CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-200.
Summary
OXID eShop 4.x before 4.1.4-21266, 3.x, and 2.x allows remote attackers to obtain sensitive information (session details and order history of other users) via a crafted cookie.
Why it matters now
EPSS 0.01076 65th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 33
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oxid:eshop:*:*:enterprise:*:*:*:*:* | up to 2.7.0.3 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:*:*:professional:*:*:*:*:* | up to 3.0.4.1 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.0.0.0_13895:*:community:*:*:*:*:* | 4.0.0.0_13895 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.0.0.0_13895:*:enterprise:*:*:*:*:* | 4.0.0.0_13895 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.0.0.0_13895:*:professional:*:*:*:*:* | 4.0.0.0_13895 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.0.0.0_13934:*:community:*:*:*:*:* | 4.0.0.0_13934 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.0.0.0_13934:*:enterprise:*:*:*:*:* | 4.0.0.0_13934 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.0.0.0_13934:*:professional:*:*:*:*:* | 4.0.0.0_13934 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.0.0.0_14260:*:community:*:*:*:*:* | 4.0.0.0_14260 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.0.0.0_14260:*:enterprise:*:*:*:*:* | 4.0.0.0_14260 | Vulnerable | Oxid |
- cpe:2.3:a:oxid:eshop:*:*:enterprise:*:*:*:*:* Versions up to 2.7.0.3 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:*:*:professional:*:*:*:*:* Versions up to 3.0.4.1 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.0.0.0_13895:*:community:*:*:*:*:* Versions 4.0.0.0_13895 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.0.0.0_13895:*:enterprise:*:*:*:*:* Versions 4.0.0.0_13895 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.0.0.0_13895:*:professional:*:*:*:*:* Versions 4.0.0.0_13895 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.0.0.0_13934:*:community:*:*:*:*:* Versions 4.0.0.0_13934 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.0.0.0_13934:*:enterprise:*:*:*:*:* Versions 4.0.0.0_13934 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.0.0.0_13934:*:professional:*:*:*:*:* Versions 4.0.0.0_13934 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.0.0.0_14260:*:community:*:*:*:*:* Versions 4.0.0.0_14260 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.0.0.0_14260:*:enterprise:*:*:*:*:* Versions 4.0.0.0_14260 Vulnerable ·Oxid
Show 23 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oxid:eshop:4.0.0.0_14260:*:professional:*:*:*:*:* | 4.0.0.0_14260 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.0.0.1_14455:*:community:*:*:*:*:* | 4.0.0.1_14455 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.0.0.1_14455:*:enterprise:*:*:*:*:* | 4.0.0.1_14455 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.0.0.1_14455:*:professional:*:*:*:*:* | 4.0.0.1_14455 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.0.0.2_14842:*:community:*:*:*:*:* | 4.0.0.2_14842 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.0.0.2_14842:*:enterprise:*:*:*:*:* | 4.0.0.2_14842 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.0.0.2_14842:*:professional:*:*:*:*:* | 4.0.0.2_14842 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.0.0.2_14967:*:community:*:*:*:*:* | 4.0.0.2_14967 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.0.0.2_14967:*:enterprise:*:*:*:*:* | 4.0.0.2_14967 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.0.0.2_14967:*:professional:*:*:*:*:* | 4.0.0.2_14967 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.0.1.0_15990:*:community:*:*:*:*:* | 4.0.1.0_15990 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.0.1.0_15990:*:enterprise:*:*:*:*:* | 4.0.1.0_15990 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.0.1.0_15990:*:professional:*:*:*:*:* | 4.0.1.0_15990 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.1.0-17976:*:community:*:*:*:*:* | 4.1.0-17976 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.1.0-17976:*:enterprise:*:*:*:*:* | 4.1.0-17976 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.1.0-17976:*:professional:*:*:*:*:* | 4.1.0-17976 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.1.1-18442:*:professional:*:*:*:*:* | 4.1.1-18442 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.1.2-18998:*:community:*:*:*:*:* | 4.1.2-18998 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.1.2-18998:*:enterprise:*:*:*:*:* | 4.1.2-18998 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.1.2-18998:*:professional:*:*:*:*:* | 4.1.2-18998 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.1.3-19918:*:community:*:*:*:*:* | 4.1.3-19918 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.1.3-19918:*:enterprise:*:*:*:*:* | 4.1.3-19918 | Vulnerable | Oxid |
| cpe:2.3:a:oxid:eshop:4.1.3-19918:*:professional:*:*:*:*:* | 4.1.3-19918 | Vulnerable | Oxid |
- cpe:2.3:a:oxid:eshop:4.0.0.0_14260:*:professional:*:*:*:*:* Versions 4.0.0.0_14260 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.0.0.1_14455:*:community:*:*:*:*:* Versions 4.0.0.1_14455 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.0.0.1_14455:*:enterprise:*:*:*:*:* Versions 4.0.0.1_14455 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.0.0.1_14455:*:professional:*:*:*:*:* Versions 4.0.0.1_14455 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.0.0.2_14842:*:community:*:*:*:*:* Versions 4.0.0.2_14842 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.0.0.2_14842:*:enterprise:*:*:*:*:* Versions 4.0.0.2_14842 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.0.0.2_14842:*:professional:*:*:*:*:* Versions 4.0.0.2_14842 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.0.0.2_14967:*:community:*:*:*:*:* Versions 4.0.0.2_14967 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.0.0.2_14967:*:enterprise:*:*:*:*:* Versions 4.0.0.2_14967 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.0.0.2_14967:*:professional:*:*:*:*:* Versions 4.0.0.2_14967 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.0.1.0_15990:*:community:*:*:*:*:* Versions 4.0.1.0_15990 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.0.1.0_15990:*:enterprise:*:*:*:*:* Versions 4.0.1.0_15990 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.0.1.0_15990:*:professional:*:*:*:*:* Versions 4.0.1.0_15990 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.1.0-17976:*:community:*:*:*:*:* Versions 4.1.0-17976 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.1.0-17976:*:enterprise:*:*:*:*:* Versions 4.1.0-17976 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.1.0-17976:*:professional:*:*:*:*:* Versions 4.1.0-17976 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.1.1-18442:*:professional:*:*:*:*:* Versions 4.1.1-18442 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.1.2-18998:*:community:*:*:*:*:* Versions 4.1.2-18998 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.1.2-18998:*:enterprise:*:*:*:*:* Versions 4.1.2-18998 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.1.2-18998:*:professional:*:*:*:*:* Versions 4.1.2-18998 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.1.3-19918:*:community:*:*:*:*:* Versions 4.1.3-19918 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.1.3-19918:*:enterprise:*:*:*:*:* Versions 4.1.3-19918 Vulnerable ·Oxid
- cpe:2.3:a:oxid:eshop:4.1.3-19918:*:professional:*:*:*:*:* Versions 4.1.3-19918 Vulnerable ·Oxid
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2009-2266
- 2026-10-03 Alias added: GHSA-ww7v-rv5h-gmwm
References
More Oxid Eshop vulnerabilities
- TI-2009-02968 Unspecified vulnerability in OXID eShop Professional, Enterprise, and Community Edition… CVSS 2.0MEDIUM 5.0
Sources
- CVE-2009-2266 · CVE Program
- CVE-2009-2266 · NVD
- FIRST EPSS
- GHSA-ww7v-rv5h-gmwm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences