PT-2024-19397 · Shopware · Shopware

Pweyck · Published 2024-01-16 · Updated 2024-01-24 · CVE-2024-22407

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.5.7.4

Description The state handler for orders in the Shopware CMS fails to sufficiently verify user authorizations for actions that modify the payment, delivery, and/or order status. Due to this inadequate implementation, users lacking 'write' permissions for orders are still able to change the order state.

Recommendations Update to Shopware 6.5.7.4 For older versions of 6.1, 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin. As a temporary workaround, consider restricting access to order state modification actions for users lacking 'write' permissions until a patch is applied.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-22407

GHSA-3867-JC5C-66QF

Affected Products

Shopware

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22407.json · Exploit
• https://github.com/shopware/shopware/security/advisories/GHSA-3867-jc5c-66qf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22407 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22407 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3867-jc5c-66qf · Vendor Advisory
• https://github.com/shopware/shopware · Note
• https://github.com/shopware/shopware/commit/fb25e24ca51650009ffa2520f1e67b48b911354a · Note
• https://github.com/shopware/core/commit/78142489264f9262eaaa436ba036df40026a06be · Note
• https://twitter.com/CVEnew/status/1747386030309675285 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1747429298489684459 · Twitter Post
• https://t.me/cvenotify/68555 · Telegram Post