PT-2022-15006 · Shopware · Shopware

Published 2022-01-05 · Updated 2022-01-12 · CVE-2022-21651

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 5.7.7

Description An open redirect issue has been discovered in Shopware, an open source e-commerce software platform, due to incomplete URL handling in the shopware router. This allows users to be arbitrarily redirected when using certain URLs. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations For versions prior to 5.7.7, update to version 5.7.7 as soon as possible. For older versions, consider using the Security Plugin as a temporary measure to enhance security. However, the primary recommendation is to update to the current version 5.7.7, which can be done via the Auto-Updater or directly via the download overview.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-21651

GHSA-C53V-QMRX-93HG

Affected Products

Shopware

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21651.json · Exploit
• https://github.com/shopware/shopware/security/advisories/GHSA-c53v-qmrx-93hg · Patch
• https://github.com/shopware/shopware/commit/a90046c765c57a46c4399dce17bd174253c32886 · Patch
• https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c53v-qmrx-93hg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21651 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21651 · Security Note
• https://github.com/shopware/shopware · Note
• https://t.me/cibsecurity/35009 · Telegram Post