Vulnerability · Published Jan 17, 2023 · Assigned by GitHub_M
CVE-2023-22734Improper Input Newsletter subscription option validation in shopware
Medium 4.3
In plain English
A medium-severity improper input validation in platform from shopware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Shopware is an open source commerce platform based on Symfony Framework and Vue js. The newsletter double opt-in validation was not checked properly, and it was possible to skip the complete double opt in process. As a result operators may have inconsistencies in their newsletter systems. This problem has been fixed with version 6.4.18.1. Users are advised to upgrade. Users unable to upgrade may find security measures are available via a plugin for major versions 6.1, 6.2, and 6.3. Users may also disable newsletter registration completely.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | shopware/core | 6.4.18.1 | GHSA-46h7-vj7x-fxg2 |
| Packagist | shopware/platform | 6.4.18.1 | GHSA-46h7-vj7x-fxg2 |
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- https://github.com/shopware/platform/security/advisories/GHSA-46h7-vj7x-fxg2 x_refsource_CONFIRM
- https://github.com/shopware/platform/commit/f5a95ee2bcf1e546878450963ef1d9886e59a620 x_refsource_MISC
- https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates x_refsource_MISC