Authorization Bypass

2022-09-1303:56:36

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

shopware

authorization bypass

vulnerability

access control

remote attack

backend admin

0.004 Low

EPSS

Percentile

72.5%

JSON

shopware/shopware is vulnerable to authorization bypass. A remote authenticated attacker is able to bypass access control lists and perform unintended acts in the system, when the backend admin controllers are called with a certain insecure notation.

CPENameOperatorVersion
shopware/shopwarelev5.7.14
shopware/shopwarelev5.7.14

CPE	Name	Operator	Version
	shopware/shopware	le	v5.7.14
	shopware/shopware	le	v5.7.14

References

docs.shopware.com/en/shopware-5-en/security-updates/security-update-09-2022

github.com/shopware/shopware/commit/de92d3a78279119a5bbe203054f8fa1d25126af6

github.com/shopware/shopware/security/advisories/GHSA-qc43-pgwq-3q2q

packagist.org/packages/shopware/shopware

0.004 Low

EPSS

Percentile

72.5%

JSON

Related for VERACODE:37008