Vulnerability · Published Mar 9, 2022 · Assigned by GitHub_M
CVE-2022-24748Incorrect Authentication in shopware
Medium 6.8
In plain English
A medium-severity improper authentication in platform from shopware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it is possible to modify customers and to create orders without App Permission. This issue is a result of improper api route checking. Users are advised to upgrade to version 6.4.8.2. There are no known workarounds.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | shopware/core | 6.4.8.2 | GHSA-83vp-6jqg-6cmr |
Affected products (as reported)
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N