# Security bulletin 2017-001 published

**URL:** <https://forum.oxid-esales.com/t/security-bulletin-2017-001-published/77293>\
**Category:** OXID Announcements\
**Tags:** security\
**Created:** [August 16, 2017, 1:32pm UTC](https://forum.oxid-esales.com/t/security-bulletin-2017-001-published/77293 "2017-08-16T13:32:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![marco.steinhaeuser](https://forum.oxid-esales.com/user_avatar/forum.oxid-esales.com/marco.steinhaeuser/32/1832_2.png) [@marco.steinhaeuser](https://forum.oxid-esales.com/u/marco.steinhaeuser)\
**Post date:** [August 16, 2017, 1:32pm UTC](https://forum.oxid-esales.com/t/security-bulletin-2017-001-published/77293/1 "2017-08-16T13:32:24Z")

</div>

Dear all,

the security bulletin 2017-001 is publicly available:

> **[Security Bulletin 2017-001 • OXIDforge](https://oxidforge.org/en/security-bulletin-2017-001.html)**
>
> CVE-2017-12415: Under certain pre-conditions an attacker would be able to hijack the cart session of a client via a Cross-Site Request Forgery (CSRF).

Under certain pre-conditions an attacker would be able to hijack the cart session of a client via a Cross-Site Request Forgery (CSRF). We calculated a CVSS = 2.2.

Regards

---

<div class="post-metadata">

**Author:** ![system](https://forum.oxid-esales.com/user_avatar/forum.oxid-esales.com/system/32/4245_2.png) [@system](https://forum.oxid-esales.com/u/system)\
**Post date:** [July 13, 2026, 8:35pm UTC](https://forum.oxid-esales.com/t/security-bulletin-2017-001-published/77293/2 "2026-07-13T20:35:57Z")

</div>

Closed on July 13, 2026, 8:35pm UTC