CVE-2023-38330: Oxid-Esales Eshop

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

OXID eShop Enterprise Edition 6.5.0 – 6.5.2 before 6.5.3 allows uploading files with modified headers in the administration area. An attacker can upload a file with a modified header to create a HTTP Response Splitting attack.

Affected products

• Oxid-Esales Eshop: from 6.5.0, before 6.5.3 (fixed in 6.5.3)

Published 2023-08-02. Last modified 2026-06-17.