GitHub Advisoryadvisory · Packagist

GHSA-83vp-6jqg-6cmr Incorrect Authentication in shopware

MEDIUM Published 2022-03-10 Modified 2022-03-18 Official page ↗
Aliases
CVE-2022-24748
Ecosystem
Packagist
Packages
shopware/core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-287, CWE-863
Reviewed
2022-03-10

Affected packages

• Packagist shopware/core: < 6.4.8.2 → fixed in 6.4.8.2

Description

Impact Modify Customers, create Orders without App Permission Patches We recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#shopware-6 Workarounds For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Related

Alias · CVE (1)

  • CVE-2022-24748 Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-863 Incorrect Authorization weakness

References