PT-2022-16850 · Shopware · Shopware

Gabor + 2 · Published 2022-03-09 · Updated 2023-06-30 · CVE-2022-24747

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.4.8.2

Description The issue arises from the improper setting of sensitive HTTP headers, making them cacheable. If an HTTP cache exists between the server and client, these headers may be exposed via HTTP caches. This affects Shopware, an open commerce platform based on the Symfony PHP framework and the Vue JavaScript framework.

Recommendations For versions prior to 6.4.8.2, update to version 6.4.8.2 to resolve the issue. For older versions of 6.1, 6.2, and 6.3, consider installing a corresponding security plugin as a temporary measure, but updating to the latest Shopware version is recommended for the full range of functions.

Exploit

Fix

Information Disclosure

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-200

CWE-668

Related Identifiers

CVE-2022-24747

GHSA-6WRH-279J-6HVW

Affected Products

Shopware

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24747.json · Exploit
• https://github.com/shopware/platform/security/advisories/GHSA-6wrh-279j-6hvw · Patch
• https://github.com/shopware/platform/commit/d51863148f32306aafdbc7f9f48887c69fce206f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24747 · Security Note
• https://osv.dev/vulnerability/GHSA-6wrh-279j-6hvw · Vendor Advisory
• https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-03-2022 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24747 · Vendor Advisory
• https://github.com/shopware/platform · Note
• https://t.me/cvenotify/27998 · Telegram Post
• https://t.me/cvenotify/53444 · Telegram Post