GitHub Advisoryadvisory · Packagist

GHSA-952p-fqcp-g8pc HTML injection possibility in voucher code form in Shopware

MEDIUM Published 2022-03-10 Modified 2022-03-18 Official page ↗
Aliases
CVE-2022-24746
Ecosystem
Packagist
Packages
shopware/platform, shopware/core, shopware/storefront
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-03-10

Affected packages

• Packagist shopware/platform: < 6.4.8.1 → fixed in 6.4.8.1 • Packagist shopware/core: < 6.4.8.1 → fixed in 6.4.8.1 • Packagist shopware/storefront: < 6.4.8.1 → fixed in 6.4.8.1

Description

Impact HTML injection possibility in voucher code form Patches Patched in 6.4.8.1, maintainers recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#shopware-6 Workarounds For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Related

Alias · CVE (1)

  • CVE-2022-24746 Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References