Vulnerability · Published Apr 20, 2022 · Assigned by GitHub_M
CVE-2022-24872Improper Access Control in shopware
High 8.1
In plain English
A high-severity incorrect permission assignment in platform from shopware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by admin-api are still usable within normal user session. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | shopware/core | 6.4.10.1 | GHSA-9wrv-g75h-8ccc |
| Packagist | shopware/platform | 6.4.10.1 | GHSA-9wrv-g75h-8ccc |
Affected products (as reported)
Weakness: CWE-732 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N