Vulnerability · Published Jan 17, 2023 · Assigned by GitHub_M
CVE-2023-22733Improper Output Neutralization in Log Module in shopware
Low 2.7
In plain English
A low-severity sensitive data in logs in platform from shopware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions the log module would write out all kind of sent mails. An attacker with access to either the local system logs or a centralized logging store may have access to other users accounts. This issue has been addressed in version 6.4.18.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. Users unable to upgrade may remove from all users the log module ACL rights or disable logging.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | shopware/core | 6.4.18.1 | GHSA-7cp7-jfp6-jh4f |
| Packagist | shopware/platform | 6.4.18.1 | GHSA-7cp7-jfp6-jh4f |
Affected products (as reported)
Weakness: CWE-532 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/shopware/platform/security/advisories/GHSA-7cp7-jfp6-jh4f x_refsource_CONFIRM
- https://github.com/shopware/platform/commit/407a83063d7141c1a626441799c3ebef79498c07 x_refsource_MISC
- https://developer.shopware.com/docs/guides/hosting/performance/performance-tweaks#logging x_refsource_MISC
- https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates x_refsource_MISC