CVE-2022-24748 Incorrect Authentication in shopware

2022-03-0922:25:09

CWE-287

GitHub_M

www.cve.org

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

0.001 Low

EPSS

Percentile

26.7%

JSON

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it is possible to modify customers and to create orders without App Permission. This issue is a result of improper api route checking. Users are advised to upgrade to version 6.4.8.2. There are no known workarounds.

CNA Affected

[
  {
    "product": "platform",
    "vendor": "shopware",
    "versions": [
      {
        "status": "affected",
        "version": "< 6.4.8.2"
      }
    ]
  }
]