GitHub Advisoryadvisory · Packagist
GHSA-qc43-pgwq-3q2q Shopware access control list bypassed via crafted specific URLs
MEDIUM
Official page ↗
- Aliases
- CVE-2022-36102
- Ecosystem
- Packagist
- Packages
- shopware/shopware
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Weaknesses
- CWE-281
- Reviewed
- 2022-09-16
Affected packages
• Packagist shopware/shopware: < 5.7.15 → fixed in 5.7.15
Description
Impact
If backend admin controllers are called with a certain notation, the ACL could be bypassed. Users could execute actions, which they are normally not able to do.
Patches
We recommend updating to the current version 5.7.15. You can get the update to 5.7.15 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/changelog-sw5/#5-7-15
For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html
References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-09-2022
Related
Alias · CVE (1)
- CVE-2022-36102 Shopware is an open source e-commerce software. vulnerability
Weakness · CWE (1)
- CWE-281 Improper Preservation of Permissions weakness
References
- https://github.com/shopware/shopware/security/advisories/GHSA-qc43-pgwq-3q2q web
- https://nvd.nist.gov/vuln/detail/CVE-2022-36102 advisory
- https://github.com/shopware/shopware/commit/de92d3a78279119a5bbe203054f8fa1d25126af6 web
- https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-09-2022 web
- https://github.com/shopware/shopware package
- https://packagist.org/packages/shopware/shopware web