PT-2025-15423 · Shopware · Shopware

Bsmietana · Published 2025-04-08 · Updated 2025-04-08 · CVE-2025-30151

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 6.6.10.3 Shopware versions prior to 6.5.8.17

Description: The issue allows an attacker to cause a Denial of Service by passing long passwords via forms in Storefront forms or Store-API.

Recommendations: For versions prior to 6.6.10.3, update to version 6.6.10.3 or later. For versions prior to 6.5.8.17, update to version 6.5.8.17 or later. For older versions of 6.4, install the corresponding security plugin. As a general recommendation, updating to the latest Shopware version is advised for the full range of functions.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-30151

GHSA-CGFJ-HJ93-RMH2

Affected Products

Shopware

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30151.json · Exploit
• https://github.com/shopware/shopware/security/advisories/GHSA-cgfj-hj93-rmh2 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cgfj-hj93-rmh2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-30151 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30151 · Security Note
• https://github.com/shopware/shopware · Note
• https://github.com/shopware/shopware/releases/tag/v6.6.10.3 · Note
• https://github.com/shopware/shopware/releases/tag/v6.7.0.0-rc2 · Note
• https://github.com/shopware/shopware/releases/tag/v6.5.8.17 · Note
• https://twitter.com/VulmonFeeds/status/1909620089235681523 · Twitter Post
• https://twitter.com/CVEnew/status/1909605266091655498 · Twitter Post
• https://t.me/cvetracker/21140 · Telegram Post
• https://t.me/cvedetector/22461 · Telegram Post