« Volver al listado

CVE-2016-5072

Estado: ModificadaAlta (8.8)—

OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Fixed versions are Enterprise Edition v5.1.12, Enterprise Edition v5.2.9, Professional Edition v4.8.12, Professional Edition v4.9.9, Community Edition v4.8.12, Community Edition v4.9.9.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Oxidforge — Oxid Eshop

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-5072",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "OXID eShop before 2016-06-13",
          "versions": [
            {
              "status": "affected",
              "version": "OXID eShop before 2016-06-13"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-04-10T03:59:01.810",
  "references": [
    {
      "url": "https://oxidforge.org/en/security-bulletin-2016-001.html",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://oxidforge.org/en/security-bulletin-2016-001.html",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Fixed versions are Enterprise Edition v5.1.12, Enterprise Edition v5.2.9, Professional Edition v4.8.12, Professional Edition v4.9.9, Community Edition v4.8.12, Community Edition v4.9.9."
    },
    {
      "lang": "es",
      "value": "OXID eShop en versiones anteriores a 13-06-2016 permite a atacantes remotos ejecutar código arbitrario a través de una solicitud GET o POST a la clase oxuser. Las versiones reparadas son Enterprise Edition v5.1.12, Enterprise Edition v5.2.9, Professional Edition v4.8.12, Professional Edition v4.9.9, Community Edition v4.8.12, Community Edition v4.9.9."
    }
  ],
  "lastModified": "2026-06-17T00:48:43.253",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oxidforge:oxid_eshop:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FBA0A862-3D70-4C72-8771-898B3CE18F82",
              "versionEndIncluding": "4.9.8"
            },
            {
              "criteria": "cpe:2.3:a:oxidforge:oxid_eshop:*:*:*:*:professional:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC414779-1E36-4DF6-8BAA-1EACA0726145",
              "versionEndIncluding": "4.9.8"
            },
            {
              "criteria": "cpe:2.3:a:oxidforge:oxid_eshop:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5F13E58F-C22D-4AF0-8954-D8BC40295B79",
              "versionEndIncluding": "5.2.8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}