PT-2022-16849 · Shopware · Shopware

Shyim · Published 2022-03-09 · Updated 2022-03-17 · CVE-2022-24746

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.4.8.1

Description The issue allows for code injection via the voucher code form, potentially leading to HTML injection. This problem has been identified in Shopware, an open commerce platform that utilizes the Symfony PHP framework and the Vue JavaScript framework. There are no known workarounds for this issue.

Recommendations For versions prior to 6.4.8.1, update to version 6.4.8.1 or later, such as 6.4.8.2, to resolve the issue. For older versions of 6.1, 6.2, and 6.3, consider installing a security plugin as a temporary measure, but updating to the latest Shopware version is recommended for the full range of functions. As a temporary workaround, consider restricting access to the voucher code form until the update can be applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-24746

GHSA-952P-FQCP-G8PC

Affected Products

Shopware

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24746.json · Exploit
• https://github.com/shopware/platform/security/advisories/GHSA-952p-fqcp-g8pc · Patch
• https://github.com/shopware/platform/commit/651598a61073cbe59368e311817bdc6e7fb349c6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24746 · Security Note
• https://osv.dev/vulnerability/GHSA-952p-fqcp-g8pc · Vendor Advisory
• https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2022 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24746 · Vendor Advisory
• https://github.com/shopware/platform · Note
• https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2022?category=security-updates · Note
• https://t.me/cvenotify/27999 · Telegram Post