PT-2022-20495 · Shopware · Shopware

Published 2022-06-22 · Updated 2022-07-07 · CVE-2022-31057

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Shopware 5 versions prior to 5.7.12

Description The issue is an authenticated Stored XSS in the Administration of Shopware, an open-source e-commerce software. Users are advised to upgrade to resolve the issue. There are no known workarounds for this problem.

Recommendations For versions prior to 5.7.12, update to version 5.7.12 using the Auto-Updater or directly via the download overview. For older versions, consider using the Security Plugin as a mitigation measure.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-31057

GHSA-Q754-VWC4-P6QJ

Affected Products

Shopware

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31057.json · Exploit
• https://github.com/shopware/shopware/commit/3e025a0a3e123f4108082645b1ced6fb548f7b6f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31057 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31057 · Vendor Advisory
• https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2022 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q754-vwc4-p6qj · Vendor Advisory
• https://github.com/shopware/shopware · Note
• https://github.com/shopware/shopware/security/advisories/GHSA-q754-vwc4-p6qj · Note
• https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2022?_ga=2.237805696.1286760707.1655914110-2145019146.1655914110 · Note
• https://shopware.com/en/changelog-sw5/#5-7-12 · Note
• https://packagist.org/packages/shopware/shopware · Note
• https://t.me/cvenotify/32252 · Telegram Post
• https://t.me/cibsecurity/45241 · Telegram Post