Vulnerability · Published Jan 17, 2023 · Assigned by GitHub_M
CVE-2023-22730Improper Input Validation of Clearance sale in cart
Medium 5.3
In plain English
A medium-severity improper input validation in platform from shopware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions It was possible to put the same line item multiple times in the cart using the AP. The Cart Validators checked the line item's individuality and the user was able to bypass quantity limits in sales. This problem has been fixed with version 6.4.18.1. Users on major versions 6.1, 6.2, and 6.3 may also obtain this fix via a plugin.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | shopware/core | 6.4.18.1 | GHSA-8r6h-m72v-38fg |
| Packagist | shopware/platform | 6.4.18.1 | GHSA-8r6h-m72v-38fg |
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://github.com/shopware/platform/security/advisories/GHSA-8r6h-m72v-38fg x_refsource_CONFIRM
- https://github.com/shopware/platform/commit/4fce12096e54b2033832d9104fa2e68888c2b4e9 x_refsource_MISC
- https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates x_refsource_MISC