PT-2022-16945 · Shopware · Shopware

Published 2022-04-28 · Updated 2022-05-06 · CVE-2022-24873

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 5.7.9

Description The issue concerns non-stored cross-site scripting in the storefront of Shopware, an open source e-commerce software platform. This occurs because request parameters were directly assigned to the template, allowing malicious code to be sent via a URL.

Recommendations For versions prior to 5.7.9, update to version 5.7.9 to resolve the issue. As a temporary workaround for older versions, consider using the Shopware security plugin to mitigate the vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-24873

GHSA-4G29-FCCR-P59W

Affected Products

Shopware

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24873.json · Exploit
• https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24873 · Vendor Advisory
• https://shopware.com/en/changelog-sw5/#5-7-9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24873 · Security Note
• https://osv.dev/vulnerability/GHSA-4g29-fccr-p59w · Vendor Advisory
• https://github.com/shopware/shopware · Note
• https://github.com/shopware/shopware/security/advisories/GHSA-4g29-fccr-p59w · Note
• https://t.me/cibsecurity/41578 · Telegram Post