CVE-2009-2266

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-09-09 · updated 2026-06-16
Weakness: CWE-200

Description

OXID eShop 4.x before 4.1.4-21266, 3.x, and 2.x allows remote attackers to obtain sensitive information (session details and order history of other users) via a crafted cookie.

Affected products

Oxid Eshop: through 2.7.0.3; through 3.0.4.1; 4.0.0.0_13895, 4.0.0.0_13934, 4.0.0.0_14260, 4.0.0.1_14455, 4.0.0.2_14842, 4.0.0.2_14967 (+5)

References

http://www.oxidforge.org/wiki/Security_bulletins/2009-003
http://www.oxidforge.org/wiki/Security_bulletins/2009-003

Get alerted when CVE-2009-2266 or the next vulnerability affects your stack