CVE-2023-2017

HighCVSS 8.8/10Last modified Oct 24, 2026

Description

Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the validation checks in `Shopware\Core\Framework\Adapter\Twig\SecurityExtension` and call any arbitrary PHP function and thus execute arbitrary code/commands via usage of fully-qualified names, supplied as array of strings, when referencing callables. Users are advised to upgrade to v6.4.20.1 to resolve this issue. This is a bypass of CVE-2023-22731.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-184 CWE-1336 CWE-94

Affected software

Vendor	Product	Versions
Shopware AG	Shopware 6	<= 6.4.20.0; >= 6.5.0.0-rc1, <= 6.5.0.0-rc4

References

https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2023Vendor Advisory
https://github.com/shopware/platform/security/advisories/GHSA-7v2v-9rm4-7m8fVendor Advisory
https://starlabs.sg/advisories/23/23-2017/Exploit, Mitigation, Third Party Advisory
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2023Vendor Advisory
https://github.com/shopware/platform/security/advisories/GHSA-7v2v-9rm4-7m8fVendor Advisory
https://starlabs.sg/advisories/23/23-2017/Exploit, Mitigation, Third Party Advisory

Timeline

Published: Apr 17, 2023
Last modified: Oct 24, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-201706.7A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on the CVE-2023-201716.5Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on CVE-2023-201724.9Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on CVE-2023-201734.9Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote CVE-2023-201744.9Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote CVE-2023-201758.8A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on the CVE-2023-201768.6A vulnerability in the networking component of Cisco access point (AP) software could allow an unauthenticated, remote attacker to cause a t CVE-2023-201774.0A vulnerability in the SSL file policy implementation of Cisco Firepower Threat Defense (FTD) Software that occurs when the SSL/TLS connecti CVE-2023-201787.8A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Softwar CVE-2023-201795.4A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authen CVE-2023-201804.3A vulnerability in the web interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site request CVE-2023-201816.1A vulnerability in the web-based management interface of Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote