PT-2024-29890 · Shopware · Shopware

Joshuabehrens · Published 2024-08-08 · Updated 2024-08-12 · CVE-2024-42354

Positive Technologies (AI Summary)

CVSS v4.0

5.9

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.6.5.1 Shopware versions prior to 6.5.8.13

Description The issue is related to the store-API, which works with regular entities and only exposes fields marked as ApiAware in the EntityDefinition to the public API. However, prior to certain versions, the processing of the Criteria did not consider ManyToMany associations, which could lead to improper consideration and failure of protections. This issue cannot be reproduced with default entities but can be triggered with extensions.

Recommendations Update to Shopware 6.6.5.1 to receive a patch. Update to Shopware 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, install the corresponding security plugin to apply security measures.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-42354

GHSA-HHCQ-PH6W-494G

Affected Products

Shopware

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42354.json · Exploit
• https://github.com/shopware/shopware/commit/ad83d38809df457efef21c37ce0996430334bf01 · Patch
• https://github.com/shopware/shopware/security/advisories/GHSA-hhcq-ph6w-494g · Vendor Advisory
• https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac · Patch
• https://github.com/shopware/core/commit/d35ee2eda5c995faeb08b3dad127eab65c64e2a2 · Patch
• https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f · Patch
• https://osv.dev/vulnerability/CVE-2024-42354 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42354 · Security Note
• https://osv.dev/vulnerability/GHSA-hhcq-ph6w-494g · Vendor Advisory
• https://github.com/shopware/shopware · Note
• https://t.me/cvedetector/2795 · Telegram Post