« Volver al listado

CVE-2014-2017

Estado: ModificadaMedia (6.1)—

CRLF injection vulnerability in OXID eShop Professional Edition before 4.7.11 and 4.8.x before 4.8.4, Enterprise Edition before 5.0.11 and 5.1.x before 5.1.4, and Community Edition before 4.7.11 and 4.8.x before 4.8.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Oxidforge — Eshop

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-2017",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-01-18T14:29:00.227",
  "references": [
    {
      "url": "https://bugs.oxid-esales.com/view.php?id=5635",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://oxidforge.org/en/security-bulletin-2014-002.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugs.oxid-esales.com/view.php?id=5635",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oxidforge.org/en/security-bulletin-2014-002.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-93"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "CRLF injection vulnerability in OXID eShop Professional Edition before 4.7.11 and 4.8.x before 4.8.4, Enterprise Edition before 5.0.11 and 5.1.x before 5.1.4, and Community Edition before 4.7.11 and 4.8.x before 4.8.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyección CRLF en OXID eShop Professional Edition en versiones anteriores a la 4.7.11 y versiones 4.8.x anteriores a la 4.8.4, Enterprise Edition en versiones anteriores a la 5.0.11 y versiones 5.1.x anteriores a la 5.1.4, y Community Edition en versiones anteriores a la 4.7.11 y versiones 4.8.x anteriores a la 4.8.4 permite que atacantes remotos inyecten cabeceras HTTP arbitrarias y lleven a cabo ataques de separación de respuesta HTTP mediante vectores sin especificar."
    }
  ],
  "lastModified": "2026-06-17T00:05:56.100",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oxidforge:eshop:*:*:*:*:professional:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B9832B3A-E424-459B-A7B3-0BA9340B19F9",
              "versionEndExcluding": "4.7.11"
            },
            {
              "criteria": "cpe:2.3:a:oxidforge:eshop:*:*:*:*:professional:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "492B4045-1EF9-46AB-BEDE-DF7CFF3142D4",
              "versionEndExcluding": "4.8.4",
              "versionStartIncluding": "4.8.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oxidforge:eshop:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9CCC0261-5936-4765-8312-1B98A1511434",
              "versionEndExcluding": "5.0.11"
            },
            {
              "criteria": "cpe:2.3:a:oxidforge:eshop:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D5B483E-C3B9-4F7A-951E-84E96B41C4E1",
              "versionEndExcluding": "5.1.4",
              "versionStartIncluding": "5.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oxidforge:eshop:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDE4017D-A067-4445-BFEE-57C7F7BBB751",
              "versionEndExcluding": "4.7.11"
            },
            {
              "criteria": "cpe:2.3:a:oxidforge:eshop:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "41A3F4A7-262F-48C8-874D-9AF25DDB939F",
              "versionEndExcluding": "4.8.4",
              "versionStartIncluding": "4.8.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}