CVE-2022-24746

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions it is possible to inject code via the voucher code form. This issue has been patched in version 6.4.8.1. There are no known workarounds for this issue.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
shopware	platform	< 6.4.8.1

References

https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2022Patch, Vendor Advisory
https://github.com/shopware/platform/commit/651598a61073cbe59368e311817bdc6e7fb349c6Patch, Third Party Advisory
https://github.com/shopware/platform/security/advisories/GHSA-952p-fqcp-g8pcPatch, Third Party Advisory
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2022Patch, Vendor Advisory
https://github.com/shopware/platform/commit/651598a61073cbe59368e311817bdc6e7fb349c6Patch, Third Party Advisory
https://github.com/shopware/platform/security/advisories/GHSA-952p-fqcp-g8pcPatch, Third Party Advisory

Timeline

Published: Mar 9, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-247475.3Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do CVE-2022-247487.5Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it i CVE-2022-247496.1Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containi CVE-2022-24758.8Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q Commands" service. Any use CVE-2022-247507.8UltraVNC is a free and open source remote pc access software. A vulnerability has been found in versions prior to 1.3.8.0 in which the DSM p CVE-2022-247517.4Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11, Zulip is vulnerable to a race condition CVE-2022-247529.8SyliusGridBundle is a package of generic data grids for Symfony applications. Prior to versions 1.10.1 and 1.11-rc2, values added at the end CVE-2022-247537.0Stripe CLI is a command-line tool for the Stripe eCommerce platform. A vulnerability in Stripe CLI exists on Windows when certain commands a CVE-2022-247549.8PJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there CVE-2022-247559.8Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director >= 18.2 >= 18.2 but p CVE-2022-247567.5Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director >= 18.2 but prior to CVE-2022-247577.5The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications. Prior to version 1.