GitHub Advisory DatabaseGHSA-5834-XV5Q-CGFWShopware vulnerable to persistent cross site scripting (XSS) in customer module
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
25.8%
Impact
Persistent XSS in customer module
Patches
We recommend updating to the current version 5.7.14. You can get the update to 5.7.14 regularly via the Auto-Updater or directly via the download overview.
For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html
References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-07-2022
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| shopware/shopware | le | 5.7.13 |
References
docs.shopware.com/en/shopware-5-en/security-updates/security-update-07-2022
github.com/advisories/GHSA-5834-xv5q-cgfw
github.com/shopware/shopware/commit/7875855005648fba7b39371a70816afae2e07daf
github.com/shopware/shopware/security/advisories/GHSA-5834-xv5q-cgfw
nvd.nist.gov/vuln/detail/CVE-2022-31148
www.shopware.com/en/changelog-sw5/#5-7-14
Related
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
25.8%