GitHub Advisoryadvisory · Packagist

GHSA-3867-jc5c-66qf Broken Access Control order API in Shopware

MEDIUM Published 2024-01-17 Modified 2024-01-17 Official page ↗
Aliases
CVE-2024-22407
Ecosystem
Packagist
Packages
shopware/core, shopware/platform
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-284
Reviewed
2024-01-17

Affected packages

• Packagist shopware/core: < 6.5.7.4 → fixed in 6.5.7.4 • Packagist shopware/platform: < 6.5.7.4 → fixed in 6.5.7.4

Description

Impact In the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions that modify the payment, delivery, and/or order status. Due to this inadequate implementation, users lacking 'write' permissions for orders are still able to change the order state. Patches Update to Shopware 6.5.7.4 Workarounds For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Related

Alias · CVE (1)

  • CVE-2024-22407 Shopware is an open headless commerce platform. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References