PT-2023-24671 · Shopware · Shopware

Published 2023-06-27 · Updated 2023-07-06 · CVE-2023-34099

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 5.7.18

Description The mail validation in the registration process had flaws, allowing the construction of different mail addresses that result in the same address, which can be shared by multiple accounts.

Recommendations For versions prior to 5.7.18, update to version 5.7.18 to address the issue. For older versions, consider using the Security Plugin as a mitigation measure.

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2023-34099

GHSA-GH66-FP7J-98V5

Affected Products

Shopware

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34099.json · Exploit
• https://github.com/shopware/shopware/security/advisories/GHSA-gh66-fp7j-98v5 · Vendor Advisory
• https://github.com/shopware5/shopware/commit/39cc714d9a0be33b43877044d0b88ea3c6b43f3d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-34099 · Security Note
• https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gh66-fp7j-98v5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-34099 · Vendor Advisory
• https://github.com/shopware5/shopware/security/advisories/GHSA-gh66-fp7j-98v5 · Note
• https://github.com/shopware5/shopware · Note
• https://shopware.com/en/changelog-sw5/#5-7-18 · Note