PT-2025-15708 · Shopware · Shopware

Lowshyim · Published 2025-04-09 · Updated 2025-04-09 · CVE-2025-32378

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 6.6.10.3 Shopware versions prior to 6.5.8.17

Description: The issue concerns the default settings for double-opt-in in Shopware, which allows for mass unsolicited newsletter sign-ups without confirmation. Specifically, with the default settings of Newsletter: Double Opt-in set to active, Newsletter: Double opt-in for registered customers set to disabled, and Log-in & sign-up: Double opt-in on sign-up set to disabled, anyone can register an account and sign up for the newsletter without needing to confirm via a link. The recipient receives confirmation emails but is set to “instantly active” in the backend.

Recommendations: For versions prior to 6.6.10.3, update to version 6.6.10.3 or later. For versions prior to 6.5.8.17, update to version 6.5.8.17 or later.

Exploit

Fix

Weakness Enumeration

CWE-799

CWE-1188

Related Identifiers

CVE-2025-32378

GHSA-4H9W-7VFP-PX8M

Affected Products

Shopware

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32378.json · Exploit
• https://github.com/shopware/shopware/security/advisories/GHSA-4h9w-7vfp-px8m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32378 · Security Note
• https://osv.dev/vulnerability/GHSA-4h9w-7vfp-px8m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32378 · Vendor Advisory
• https://github.com/shopware/shopware · Note
• https://twitter.com/CVEnew/status/1910073452096036915 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1910027162528186388 · Twitter Post