PT-2022-16951 · Shopware · Shopware

Published 2022-04-28 · Updated 2022-05-07 · CVE-2022-24879

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 5.7.9

Description The issue concerns a malfunction in cross-site request forgery (CSRF) token validation. Under certain circumstances, the CSRF tokens were not generated anew and not validated correctly. This could allow an attacker to impersonate a victim if the attacker is able to use the same device as the victim used beforehand.

Recommendations For versions prior to 5.7.9, update to version 5.7.9 to resolve the issue. As a temporary workaround for older versions, consider using the Shopware security plugin to mitigate the vulnerability.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-24879

GHSA-PF38-V6QJ-J23H

Affected Products

Shopware

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24879.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-24879 · Security Note
• https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pf38-v6qj-j23h · Vendor Advisory
• https://shopware.com/en/changelog-sw5/#5-7-9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24879 · Vendor Advisory
• https://github.com/shopware/shopware · Note
• https://github.com/shopware/shopware/security/advisories/GHSA-pf38-v6qj-j23h · Note
• https://t.me/cvenotify/29823 · Telegram Post
• https://t.me/cibsecurity/41573 · Telegram Post