CVE-2015-6926

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The OpenID Single Sign-On authentication functionality in OXID eShop before 4.5.0 allows remote attackers to impersonate users via the email address in a crafted authentication token.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugs.oxid-esales.com/view.php?id=6224Issue Tracking, Vendor Advisory
https://oxidforge.org/en/oxid-security-bulletin-2015-001.htmlMitigation, Vendor Advisory
https://bugs.oxid-esales.com/view.php?id=6224Issue Tracking, Vendor Advisory
https://oxidforge.org/en/oxid-security-bulletin-2015-001.htmlMitigation, Vendor Advisory

Timeline

Published: Jan 19, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-69273.6vzctl before 4.9.4 determines the virtual environment (VE) layout based on the presence of root.hdd/DiskDescriptor.xml in the VE private dir CVE-2015-69286.8classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a password reset request was CVE-2015-69294.3Multiple cross-site scripting (XSS) vulnerabilities in Nokia Networks (formerly Nokia Solutions and Networks and Nokia Siemens Networks) @va CVE-2015-69316.1Cross-site scripting (XSS) vulnerability in the vSphere Web Client in VMware vCenter Server 5.0 before U3g, 5.1 before U3d, and 5.5 before U CVE-2015-69325.8VMware vCenter Server 5.5 before u3 and 6.0 before u1 does not verify X.509 certificates from TLS LDAP servers, which allows man-in-the-midd CVE-2015-69336.3The VMware Tools HGFS (aka Shared Folders) implementation in VMware Workstation 11.x before 11.1.2, VMware Player 7.x before 7.1.2, VMware F CVE-2015-69347.3Serialized-object interfaces in VMware vRealize Orchestrator 6.x, vCenter Orchestrator 5.x, vRealize Operations 6.x, vCenter Operations 5.x,CVE-2015-69374.9The __rds_conn_create function in net/rds/connection.c in the Linux kernel through 4.2.3 allows local users to cause a denial of service (NU CVE-2015-69384.3Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Noteboo CVE-2015-69394.3Cross-site scripting (XSS) vulnerability in the login module in Joomla! 3.4.x before 3.4.4 allows remote attackers to inject arbitrary web s CVE-2015-69405.0The GetResource servlet in Pentaho Business Analytics (BA) Suite 4.5.x, 4.8.x, and 5.0.x through 5.2.x and Pentaho Data Integration (PDI) Su CVE-2015-69419.8win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in de