PT-2022-20563 · Shopware · Shopware

Published 2022-07-27 · Updated 2022-08-05 · CVE-2022-31148

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Shopware versions 5.7.0 through 5.7.13

Description A persistent cross-site scripting (XSS) issue exists in the customer module. This allows for malicious scripts to be executed in the context of the user's session. Users are recommended to update to the current version to resolve the issue. There are no known workarounds for this problem.

Recommendations For versions 5.7.0 through 5.7.13, update to version 5.7.14 via the Auto-Updater or directly via the download overview. For older versions, consider using the Security Plugin as a temporary mitigation measure until a more permanent solution can be applied. As a temporary workaround, consider restricting access to the customer module until the update to version 5.7.14 can be applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-31148

GHSA-5834-XV5Q-CGFW

Affected Products

Shopware

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31148.json · Exploit
• https://github.com/shopware/shopware/commit/7875855005648fba7b39371a70816afae2e07daf · Patch
• https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-07-2022 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31148 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31148 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5834-xv5q-cgfw · Vendor Advisory
• https://github.com/shopware/shopware · Note
• https://github.com/shopware/shopware/security/advisories/GHSA-5834-xv5q-cgfw · Note
• https://t.me/cvenotify/34331 · Telegram Post
• https://t.me/cibsecurity/47359 · Telegram Post
• https://t.me/cvenotify/34105 · Telegram Post
• https://shopware.com/en/changelog-sw5/#5-7-14 · Note