How to report a security issue
You write to us
Send your description of the issue by email to [email protected].
We confirm receipt
We confirm that your email or bug report has reached OXID eSales.
We keep you posted
You learn how far the review and fix have progressed and when a security fix or a new version is expected to be available.
Confidential and anonymous
We treat all reports confidentially and anonymously. If you like, we will gladly credit you in our security bulletin as the person who discovered the vulnerability.
Your contact
Michael Keiluweit
Technical Security Expert, OXID eSales AG
Found a vulnerability or have a question about the reporting process? Write to [email protected].
Send an emailFix first, then disclose
Our principle: we keep public knowledge of a security issue limited until a solution is available. That way stores are not exposed to security gaps that are publicly known but not yet closed.
Supported versions
When we publish new security advisories, we check whether supported OXID eShop versions are affected. Older, unsupported versions may have the same vulnerabilities, but do not have to. We do not provide security fixes for older versions – so keep your OXID eShop installation up to date.
Modules and extensions
- In an extension by OXID eSales: Write to us at [email protected].
- In a third-party extension: Contact the developer of the extension first. If you cannot find them or get no response, get in touch with us.
How we inform you about security topics
Release emails
We let you know as soon as a new version with a security fix is released.
Newsletter
You also learn about security-related news through our newsletter.
Security mailing lists
We use them to inform other vendors and Linux distributors about a security bulletin.
The path to publication
- We publish a security bulletin as soon as our team has verified and fixed the issue – that is, once a fix for existing versions is available or a new version containing the fix is released.
- We do not publicly disclose vulnerabilities that have not yet been fixed in stable versions.
- Close partners of OXID eSales are notified about the upcoming bulletin roughly 48 to 96 hours in advance.
Questions about the reporting process?
Write to us at [email protected] – we are happy to help.
[email protected]