{"id":"CVE-2009-2266","aliases":["EUVD-2009-2262","GHSA-ww7v-rv5h-gmwm"],"status":"published","title":"OXID eShop 4.x before 4.1.4-21266, 3.x, and 2.x allows remote attackers to obtain sensitive...","description":"OXID eShop 4.x before 4.1.4-21266, 3.x, and 2.x allows remote attackers to obtain sensitive information (session details and order history of other users) via a crafted cookie.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01076,"percentile":0.65235,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2009-09-09T17:00:00Z","modified":"2026-06-16T23:09:06Z","products":[{"vendor":"oxid","product":"eshop"}],"references":[{"url":"http://www.oxidforge.org/wiki/Security_bulletins/2009-003","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2266"},{"url":"https://github.com/advisories/GHSA-ww7v-rv5h-gmwm"}],"sources":{"cve":[{"id":"CVE-2009-2266","description":"OXID eShop 4.x before 4.1.4-21266, 3.x, and 2.x allows remote attackers to obtain sensitive information (session details and order history of other users) via a crafted cookie.","status":"published","published":"2009-09-09T17:00:00Z","modified":"2024-09-16T20:16:28.127Z","updated_at":"2026-11-02T14:33:23.395558Z"}],"euvd":[{"id":"EUVD-2009-2262","description":"OXID eShop 4.x before 4.1.4-21266, 3.x, and 2.x allows remote attackers to obtain sensitive information (session details and order history of other users) via a crafted cookie.","status":"published","published":"2009-09-09T17:00:00Z","modified":"2024-09-16T20:16:28Z","updated_at":"2026-11-03T00:55:15.889317Z"}],"ghsa":[{"id":"GHSA-ww7v-rv5h-gmwm","title":"OXID eShop 4.x before 4.1.4-21266, 3.x, and 2.x allows remote attackers to obtain sensitive...","description":"OXID eShop 4.x before 4.1.4-21266, 3.x, and 2.x allows remote attackers to obtain sensitive information (session details and order history of other users) via a crafted cookie.","status":"published","published":"2022-05-02T03:33:25Z","modified":"2023-01-31T05:08:13Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:49:21.399059Z"}],"nvd":[{"id":"CVE-2009-2266","description":"OXID eShop 4.x before 4.1.4-21266, 3.x, and 2.x allows remote attackers to obtain sensitive information (session details and order history of other users) via a crafted cookie.","status":"published","published":"2009-09-09T17:30:01.28Z","modified":"2026-06-16T23:09:06.097Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:01:36.596719Z"}]}}