How to report a security issue
You write to us
Send your description of the issue by email to [email protected].
We confirm receipt
We confirm that your email or bug report has reached OXID eSales.
We keep you posted
We let you know how the review and fix are progressing and when a security fix or a new version is expected.
Confidential by default
We treat all reports confidentially and keep your identity private. If you wish, we will gladly credit you in our security bulletin as the person who discovered the vulnerability.
Your contact
Michael Keiluweit
Technical Security Expert, OXID eSales AG
Found a vulnerability or have a question about the reporting process? Write to [email protected].
Send an emailFix first, then disclose
Our principle: we keep public knowledge of a security issue limited until a solution is available. That way stores are not exposed to security gaps that are publicly known but not yet closed.
Supported versions
When we publish new security advisories, we check whether supported OXID eShop versions are affected. Older, unsupported versions may or may not have the same vulnerabilities. We do not provide security fixes for older versions – so keep your OXID eShop installation up to date.
Modules and extensions
- In an extension by OXID eSales: Write to us at [email protected].
- In a third-party extension: Contact the developer of the extension first. If you cannot find them or get no response, get in touch with us.
How we inform you about security topics
Security bulletins
Published in our documentation at docs.oxid-esales.com.
View the security bulletinsRelease emails
We let you know as soon as a new version with a security fix is released.
Newsletter
Our newsletter also covers security-related news.
Security mailing lists
We use them to inform other vendors and Linux distributors about a security bulletin.
The path to publication
- We publish a security bulletin as soon as our team has verified and fixed the issue – that is, once a fix for existing versions is available or a new version containing the fix is released.
- We do not publicly disclose vulnerabilities that have not yet been fixed in stable versions.
- Close partners of OXID eSales are notified about the upcoming bulletin roughly 48 to 96 hours in advance.
Questions about the reporting process?
Write to us at [email protected] – we are happy to help.
[email protected]