Privilege Escalation

2022-04-2103:25:01

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

42.3%

JSON

shopware/platform and shopware/core are vulnerable to privilege escalation. Lack of secure handling allows the permissions set by admin-api for sales channel context to be able use within normal user sessions.

CPENameOperatorVersion
shopware/platformle6.4.10.0
shopware/corele6.4.10.0
shopware/platformle6.4.10.0
shopware/corele6.4.10.0

Name	Operator	Version
shopware/platform	le	6.4.10.0
shopware/core	le	6.4.10.0
shopware/platform	le	6.4.10.0
shopware/core	le	6.4.10.0

References

docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022

github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77c

github.com/shopware/platform/security/advisories/GHSA-9wrv-g75h-8ccc

0.001 Low

EPSS

Percentile

42.3%

JSON

Related for VERACODE:35187