GitHub Advisoryadvisory · Packagist

GHSA-7cp7-jfp6-jh4f Shopware's log module vulnerable to Improper Output Neutralization

LOW Published 2023-01-20 Modified 2023-01-25 Official page ↗
Aliases
CVE-2023-22733
Ecosystem
Packagist
Packages
shopware/platform, shopware/core
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-117, CWE-532
Reviewed
2023-01-20

Affected packages

• Packagist shopware/platform: < 6.4.18.1 → fixed in 6.4.18.1 • Packagist shopware/core: < 6.4.18.1 → fixed in 6.4.18.1

Description

Impact The log module contains all kind of sent mails. It is possible to see the password reset email of customers and admin users to gain probably more access. Patches Update to the latest 6.4.18.1 version. Workarounds • For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. • Remove from all users the log module ACL rights • Disable logging References https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates

Related

Alias · CVE (1)

  • CVE-2023-22733 Shopware is an open source commerce platform based on Symfony Framework and Vue js. vulnerability

Weakness · CWE (2)

  • CWE-117 Improper Output Neutralization for Logs weakness
  • CWE-532 Insertion of Sensitive Information into Log File weakness

References