CVSS: 9.0EPSS: 1%CPEs: 4EXPL: 1CVE-2023-2017 – Improper Control of Generation of Code in Twig Rendered Views in Shopware
https://notcve.org/view.php?id=CVE-2023-2017
17 Apr 2023 — Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the validation checks in `Shopware\Core\Framework\Adapter\Twig\SecurityExtension` and call any arbitrary PHP function and thus execute arbitrary code/commands via usage of fully-qualified names, supplied as array of strings, when referencing ca... • https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2023 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-184: Incomplete List of Disallowed Inputs CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-22733 – Improper Output Neutralization in Log Module in shopware
https://notcve.org/view.php?id=CVE-2023-22733
17 Jan 2023 — Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions the log module would write out all kind of sent mails. An attacker with access to either the local system logs or a centralized logging store may have access to other users accounts. This issue has been addressed in version 6.4.18.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. • https://developer.shopware.com/docs/guides/hosting/performance/performance-tweaks#logging • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-22732 – Insufficient Session Expiration in Administration in shopware
https://notcve.org/view.php?id=CVE-2023-22732
17 Jan 2023 — Shopware is an open source commerce platform based on Symfony Framework and Vue js. The Administration session expiration was set to one week, when an attacker has stolen the session cookie they could use it for a long period of time. In version 6.4.18.1 an automatic logout into the Administration session has been added. As a result the user will be logged out when they are inactive. Users are advised to upgrade. • https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates • CWE-613: Insufficient Session Expiration •
CVSS: 9.9EPSS: 4%CPEs: 1EXPL: 0CVE-2023-22731 – Improper Control of Generation of Code in Twig rendered views in shopware
https://notcve.org/view.php?id=CVE-2023-22731
17 Jan 2023 — Shopware is an open source commerce platform based on Symfony Framework and Vue js. In a Twig environment **without the Sandbox extension**, it is possible to refer to PHP functions in twig filters like `map`, `filter`, `sort`. This allows a template to call any global PHP function and thus execute arbitrary code. The attacker must have access to a Twig environment in order to exploit this vulnerability. This problem has been fixed with 6.4.18.1 with an override of the specified filters until the integratio... • https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-22730 – Improper Input Validation of Clearance sale in cart
https://notcve.org/view.php?id=CVE-2023-22730
17 Jan 2023 — Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions It was possible to put the same line item multiple times in the cart using the AP. The Cart Validators checked the line item's individuality and the user was able to bypass quantity limits in sales. This problem has been fixed with version 6.4.18.1. Users on major versions 6.1, 6.2, and 6.3 may also obtain this fix via a plugin. • https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-22734 – Improper Input Newsletter subscription option validation in shopware
https://notcve.org/view.php?id=CVE-2023-22734
17 Jan 2023 — Shopware is an open source commerce platform based on Symfony Framework and Vue js. The newsletter double opt-in validation was not checked properly, and it was possible to skip the complete double opt in process. As a result operators may have inconsistencies in their newsletter systems. This problem has been fixed with version 6.4.18.1. Users are advised to upgrade. • https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates • CWE-20: Improper Input Validation •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24872 – Improper Access Control in shopware
https://notcve.org/view.php?id=CVE-2022-24872
20 Apr 2022 — Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by admin-api are still usable within normal user session. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue. • https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24871 – Server-Side Request Forgery (SSRF) in Shopware
https://notcve.org/view.php?id=CVE-2022-24871
20 Apr 2022 — Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the Admin SDK functionality on the server to read or update internal resources. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue. • https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24744 – Insufficient Session Expiration in shopware
https://notcve.org/view.php?id=CVE-2022-24744
09 Mar 2022 — Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. Shopware es una plataforma de comercio abierto basada en el Framework php Symfony y el framework javascript Vue. • https://github.com/shopware/platform/security/advisories/GHSA-w267-m9c4-8555 • CWE-613: Insufficient Session Expiration •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24745 – Guest session is shared between customers in shopware
https://notcve.org/view.php?id=CVE-2022-24745
09 Mar 2022 — Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessions are shared between customers when HTTP cache is enabled. This can lead to inconsistent experiences for guest users. Setups with Varnish are not affected by this issue. This issue has been resolved in version 6.4.8.2. • https://github.com/shopware/platform/security/advisories/GHSA-jp6h-mxhx-pgqh • CWE-384: Session Fixation •