PT-2022-23193 · Shopware · Shopware

Published 2022-09-12 · Updated 2022-09-16 · CVE-2022-36102

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 5.7.15

Description The issue allows users to bypass the Access Control List (ACL) if backend admin controllers are called with a certain notation, enabling them to execute actions they are normally not able to do. There are no known workarounds for this issue.

Recommendations For versions prior to 5.7.15, update to version 5.7.15 via the Auto-Updater or directly via the download overview. For older versions, consider using the Security Plugin as a mitigation measure until a patch is available. As a temporary workaround, consider restricting access to backend admin controllers to minimize the risk of exploitation.

Exploit

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2022-36102

GHSA-QC43-PGWQ-3Q2Q

Affected Products

Shopware

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36102.json · Exploit
• https://github.com/shopware/shopware/commit/de92d3a78279119a5bbe203054f8fa1d25126af6 · Patch
• https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-09-2022 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36102 · Security Note
• https://osv.dev/vulnerability/GHSA-qc43-pgwq-3q2q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36102 · Vendor Advisory
• https://github.com/shopware/shopware · Note
• https://github.com/shopware/shopware/security/advisories/GHSA-qc43-pgwq-3q2q · Note
• https://t.me/cvenotify/36247 · Telegram Post
• https://packagist.org/packages/shopware/shopware · Note
• https://t.me/cibsecurity/49607 · Telegram Post