CVE-2022-24872

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by admin-api are still usable within normal user session. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
shopware	platform	< 6.4.10.1

References

https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022Patch, Vendor Advisory
https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77cPatch, Third Party Advisory
https://github.com/shopware/platform/security/advisories/GHSA-9wrv-g75h-8cccThird Party Advisory
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022Patch, Vendor Advisory
https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77cPatch, Third Party Advisory
https://github.com/shopware/platform/security/advisories/GHSA-9wrv-g75h-8cccThird Party Advisory

Timeline

Published: Apr 20, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-248736.1Shopware is an open source e-commerce software platform. Prior to version 5.7.9, Shopware is vulnerable to non-stored cross-site scripting i CVE-2022-248757.5The CVEProject/cve-services is an open source project used to operate the CVE services api. In versions up to and including 1.1.1 the `org.c CVE-2022-248765.4GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. CVE-2022-248778.8Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kust CVE-2022-248786.5Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kust CVE-2022-248797.5Shopware is an open source e-commerce software platform. Versions prior to 5.7.9 are vulnerable to malfunction of cross-site request forgery CVE-2022-24889.8A vulnerability was found in WAVLINK WN535K2 and WN535K3 and classified as critical. This issue affects some unknown processing of the file CVE-2022-248805.3flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In v CVE-2022-248819.8Ballcat Codegen provides the function of online editing code to generate templates. In versions prior to 1.0.0.beta.2, attackers can impleme CVE-2022-248827.5FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does CVE-2022-248839.8FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authentication against a `SAM` fi CVE-2022-248847.5ecdsautils is a tiny collection of programs used for ECDSA (keygen, sign, verify). `ecdsa_verify_[prepare_]legacy()` does not check whether