PT-2022-16851 · Shopware · Shopware

Lowshyim · Published 2022-03-09 · Updated 2023-06-23 · CVE-2022-24748

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.4.8.2

Description The issue is a result of improper API route checking, allowing modification of customers and creation of orders without App Permission. This affects Shopware, an open commerce platform based on the Symfony php Framework and the Vue javascript framework.

Recommendations For versions prior to 6.4.8.2, upgrade to version 6.4.8.2 to resolve the issue. For older versions of 6.1, 6.2, and 6.3, consider installing a security plugin for corresponding security measures, but note that updating to the latest Shopware version is recommended for the full range of functions.

Exploit

Fix

Incorrect Authorization

Improper Authentication

Weakness Enumeration

CWE-863

CWE-287

Related Identifiers

CVE-2022-24748

GHSA-83VP-6JQG-6CMR

Affected Products

Shopware

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24748.json · Exploit
• https://github.com/shopware/platform/security/advisories/GHSA-83vp-6jqg-6cmr · Patch
• https://github.com/shopware/core/commit/329e4d7e028dd8081496cf8bd3acc822000b0ec0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24748 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24748 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-83vp-6jqg-6cmr · Vendor Advisory
• https://github.com/shopware/platform · Note
• https://t.me/cvenotify/27997 · Telegram Post
• https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-03-2022?_ga=2.27683580.172848620.1646933022-368790926.1646933022 · Note