CVE-2023-22730

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions It was possible to put the same line item multiple times in the cart using the AP. The Cart Validators checked the line item's individuality and the user was able to bypass quantity limits in sales. This problem has been fixed with version 6.4.18.1. Users on major versions 6.1, 6.2, and 6.3 may also obtain this fix via a plugin.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jan 17, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-227318.8Shopware is an open source commerce platform based on Symfony Framework and Vue js. In a Twig environment **without the Sandbox extension**,CVE-2023-227329.8Shopware is an open source commerce platform based on Symfony Framework and Vue js. The Administration session expiration was set to one wee CVE-2023-227336.5Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions the log module would write out all CVE-2023-227347.5Shopware is an open source commerce platform based on Symfony Framework and Vue js. The newsletter double opt-in validation was not checked CVE-2023-227354.6Zulip is an open-source team collaboration tool. In versions of zulip prior to commit `2f6c5a8` but after commit `04cf68b` users could uploa CVE-2023-227368.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions starting with 2.5.0-rc1 and above, prior to 2.5.8, and ve CVE-2023-227376.5wire-server provides back end services for Wire, a team communication and collaboration platform. Prior to version 2022-12-09, every member CVE-2023-227386.5vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different orga CVE-2023-227396.5Discourse is an open source platform for community discussion. Versions prior to 3.0.1 (stable), 3.1.0.beta2 (beta), and 3.1.0.beta2 (tests-CVE-2023-227406.5Discourse is an open source platform for community discussion. Versions prior to 3.1.0.beta1 (beta) (tests-passed) are vulnerable to Alloca CVE-2023-227419.8Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. In affected versions Sofia-SIP **lacks bo CVE-2023-227425.9libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 doe