CVE-2023-38330
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
OXID eShop Enterprise Edition versions 6.5.0 – 6.5.2 before 6.5.3 allows uploading files with modified headers in the administration area. An attacker can upload a file with a modified header, leading to an HTTP Response Splitting attack.
Risk Assessment
The risk to the organization involves the potential for an HTTP Response Splitting attack, which could lead to data leakage or manipulation of server responses.
Recommendation
It is recommended to update OXID eShop to version 6.5.3 or later to mitigate this vulnerability.
Original NVD description (English source)
OXID eShop Enterprise Edition 6.5.0 – 6.5.2 before 6.5.3 allows uploading files with modified headers in the administration area. An attacker can upload a file with a modified header to create a HTTP Response Splitting attack.