PT-2022-23192 · Shopware · Shopware

Published 2022-09-12 · Updated 2023-07-21 · CVE-2022-36101

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 5.7.15

Description The request for the customer detail view in the backend administration contained sensitive data like the hashed password and the session ID. There are no known workarounds for this issue.

Recommendations For versions prior to 5.7.15, update to version 5.7.15 via the Auto-Updater or directly via the download overview. For older versions, consider using the Security Plugin as a mitigation measure until the update to 5.7.15 can be applied.

Exploit

Fix

Information Disclosure

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-200

CWE-312

Related Identifiers

CVE-2022-36101

GHSA-6VFQ-JMXG-G58R

Affected Products

Shopware

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36101.json · Exploit
• https://github.com/shopware/shopware/commit/af5cdbc81d60f21b728e1433aeb8837f25938d2a · Patch
• https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-09-2022 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36101 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36101 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6vfq-jmxg-g58r · Vendor Advisory
• https://github.com/shopware/shopware · Note
• https://github.com/shopware/shopware/security/advisories/GHSA-6vfq-jmxg-g58r · Note
• https://t.me/cvenotify/36245 · Telegram Post
• https://t.me/cibsecurity/49615 · Telegram Post
• https://packagist.org/packages/shopware/shopware · Note