Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions it is possible to inject code via the voucher code form. This issue has been patched in version 6.4.8.1. There are no known workarounds for this issue.
References
| Link | Resource |
|---|---|
| https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2022 | Patch Vendor Advisory |
| https://github.com/shopware/platform/commit/651598a61073cbe59368e311817bdc6e7fb349c6 | Patch Third Party Advisory |
| https://github.com/shopware/platform/security/advisories/GHSA-952p-fqcp-g8pc | Patch Third Party Advisory |
Configurations
History
17 Mar 2022, 16:42
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Shopware shopware
Shopware |
|
| References | (MISC) https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2022 - Patch, Vendor Advisory | |
| References | (CONFIRM) https://github.com/shopware/platform/security/advisories/GHSA-952p-fqcp-g8pc - Patch, Third Party Advisory | |
| References | (MISC) https://github.com/shopware/platform/commit/651598a61073cbe59368e311817bdc6e7fb349c6 - Patch, Third Party Advisory | |
| CPE | cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 6.1 |
09 Mar 2022, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-03-09 23:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-24746
Mitre link : CVE-2022-24746
CVE.ORG link : CVE-2022-24746
JSON object : View
Products Affected
shopware
- shopware
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')