PT-2025-15422 · Shopware · Shopware 6

Niklaswolf · Published 2025-04-08 · Updated 2025-04-08 · CVE-2025-30150

Positive Technologies (AI Summary)

CVSS v4.0

5.5

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Green

Name of the Vulnerable Software and Affected Versions: Shopware 6 versions prior to 6.6.10.3 Shopware 6 versions prior to 6.5.8.17

Description: The issue allows an attacker to determine if a specific email address has an account in the shop. This is achieved through the store-api endpoint "/store-api/account/recovery-password", which returns a response indicating whether the account exists or not.

Recommendations: For versions prior to 6.6.10.3, update to version 6.6.10.3 or later. For versions prior to 6.5.8.17, update to version 6.5.8.17 or later. For older versions of 6.4, install the corresponding security plugin. As a general recommendation, update to the latest Shopware version for the full range of functions.

Exploit

Fix

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2025-30150

GHSA-HH7J-6X3Q-F52H

Affected Products

Shopware 6

References · 12

• 🔥 https://github.com/shopware/shopware/security/advisories/GHSA-hh7j-6x3q-f52h · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30150.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-30150 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30150 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hh7j-6x3q-f52h · Vendor Advisory
• https://github.com/shopware/shopware · Note
• https://github.com/shopware/shopware/releases/tag/v6.6.10.3 · Note
• https://github.com/shopware/shopware/releases/tag/v6.7.0.0-rc2 · Note
• https://github.com/shopware/shopware/releases/tag/v6.5.8.17 · Note
• https://twitter.com/CVEnew/status/1909611279368831446 · Twitter Post
• https://t.me/cvedetector/22460 · Telegram Post
• https://t.me/cvetracker/21139 · Telegram Post