PT-2024-40417 · Shopware · Shopware

Published 2024-05-21 · Updated 2024-05-21

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 5.2.14

Description The issue allows for the execution of unauthorized foreign code under certain circumstances, posing a critical security risk that could impact the entire system.

Recommendations For versions prior to 5.2.14, update to a version that includes the fix for this issue to prevent potential exploitation.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

GHSA-Q3G4-2VW9-XV27

Affected Products

Shopware

References · 6

• https://osv.dev/vulnerability/GHSA-q3g4-2vw9-xv27 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/shopware/shopware/2017-01-24.yaml · Note
• https://github.com/shopware5/shopware · Note
• https://github.com/shopware5/shopware/commit/14299e9ee9f7d93f687b4ec838e0873afbc84fec · Note
• https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-01-2017?category=shopware-5-en/security-updates · Note
• https://community.shopware.com/_detail_1989.html · Note