HIGHCVSS 7.5EPSS 0.3%

CVE-2024-56526

OXID eShop May Display User Information

Published: 2025-05-13
Modified: 2026-07-30
EPSS percentile: 23%
Aliases: GHSA-qqcr-9jfc-35c4
Sources: github-advisory

Summary

An issue was discovered in OXID eShop before 7. CMS pages in combination with Smarty may display user information if a CMS page contains a Smarty syntax error.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Packagist	oxid-esales/oxideshop-ce	—	6.14.4
Packagist	oxid-esales/oxideshop-metapackage-ce	—	6.5.5
Packagist	oxid-esales/smarty-component	—	1.0.1

Remediation: Upgrade to 6.14.4 or later.

References

https://github.com/advisories/GHSA-qqcr-9jfc-35c4

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.