PT-2022-16944 · Shopware · Shopware

Nils Evers · Published 2022-04-20 · Updated 2022-05-03 · CVE-2022-24872

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.4.10.1

Description The issue concerns permissions set to sales channel context by admin-api, which remain usable within a normal user session. This affects Shopware, an open commerce platform based on Symfony Framework and Vue. There are no known workarounds for this issue.

Recommendations For versions 6.1, 6.2, and 6.3, install the corresponding security plugin to address the issue. For all affected versions, update to version 6.4.10.1 to resolve the issue. The update can be obtained regularly via the Auto-Updater or directly via the download overview.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2022-24872

GHSA-9WRV-G75H-8CCC

Affected Products

Shopware

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24872.json · Exploit
• https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77c · Patch
• https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24872 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24872 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9wrv-g75h-8ccc · Vendor Advisory
• https://github.com/shopware/platform · Note
• https://github.com/shopware/platform/security/advisories/GHSA-9wrv-g75h-8ccc · Note
• https://t.me/cvenotify/29245 · Telegram Post