PT-2023-18675 · Shopware · Shopware

Shyim · Published 2023-01-17 · Updated 2023-01-25 · CVE-2023-22733

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.4.18.1

Description The log module in Shopware writes out all kinds of sent mails, potentially allowing an attacker with access to local system logs or a centralized logging store to access other users' accounts. This issue can be exploited to gain access to password reset emails of customers and admin users, potentially leading to further unauthorized access.

Recommendations For versions 6.1, 6.2, and 6.3, install the corresponding security plugin to address the issue. For all affected versions, remove the log module ACL rights from all users as a temporary workaround. Disable logging until the issue is fully resolved. Update to version 6.4.18.1 or later for the full range of functions and to fully address the issue.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

CWE-117

Related Identifiers

CVE-2023-22733

GHSA-7CP7-JFP6-JH4F

Affected Products

Shopware

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22733.json · Exploit
• https://github.com/shopware/platform/commit/407a83063d7141c1a626441799c3ebef79498c07 · Patch
• https://developer.shopware.com/docs/guides/hosting/performance/performance-tweaks#logging · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22733 · Security Note
• https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-22733 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7cp7-jfp6-jh4f · Vendor Advisory
• https://github.com/shopware/platform · Note
• https://github.com/shopware/platform/security/advisories/GHSA-7cp7-jfp6-jh4f · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22733 · Note
• https://t.me/cibsecurity/56635 · Telegram Post