CVE-2024-56526 OXID eShop May Display User Information
Attackers can view user information via CMS pages with Smarty syntax errors in OXID eShop.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-56526?
CVE-2024-56526 is a high-severity vulnerability in n/a, published on 13 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in OXID eShop before 7. CMS pages in combination with Smarty may display user information if a CMS page contains a Smarty syntax error.
Weakness: CWE-200
Which versions are affected by CVE-2024-56526?
6 open source packages ship an affected version, including oxid-esales/oxideshop-ce, oxid-esales/oxideshop-metapackage-ce and oxid-esales/smarty-component. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
oxid-esales/oxideshop-ce Packagist | From 6.0.0 | 6.14.4 |
oxid-esales/oxideshop-ce Packagist | From 6.0.0 | 6.14.4 |
oxid-esales/oxideshop-metapackage-ce Packagist | From 6.0.0 | 6.5.5 |
oxid-esales/oxideshop-metapackage-ce Packagist | From 6.0.0 | 6.5.5 |
oxid-esales/smarty-component Packagist | All versions | 1.0.1 |
oxid-esales/smarty-component Packagist | All versions | 1.0.1 |
Products include Oxid-Esales Eshop.
How do I fix CVE-2024-56526?
Upgrade oxid-esales/oxideshop-ce to 6.14.4 or later.
Is CVE-2024-56526 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-56526 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-qqcr-9jfc-35c4.