CVE-2023-34098

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Shopware is an open source e-commerce software. Due to an incorrect configuration in the `.htaccess` file, the configuration file of the Javascript could be read in production environments (`themes/package-lock.json`). With this information, the specific Shopware version in a deployment might be determined by an attacker, which could be used for further attacks. Users are advised to update to version 5.7.18. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Jun 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-340995.3Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to constr CVE-2023-34105.4The Bricks theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘customTag' attribute in versions up to, and including, CVE-2023-341006.5Contiki-NG is an open-source, cross-platform operating system for IoT devices. When reading the TCP MSS option value from an incoming packet CVE-2023-341019.1Contiki-NG is an operating system for internet of things devices. In version 4.8 and prior, when processing ICMP DAO packets in the `dao_inp CVE-2023-341028.8Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updatin CVE-2023-341035.4Avo is an open source ruby on rails admin panel creation framework. In affected versions some avo fields are vulnerable to Cross Site Script CVE-2023-341047.5fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not esca CVE-2023-341057.5SRS is a real-time video server supporting RTMP, WebRTC, HLS, HTTP-FLV, SRT, MPEG-DASH, and GB28181. Prior to versions 5.0.157, 5.0-b1, and CVE-2023-341066.5GLPI is a free asset and IT management software package. Versions of the software starting with 0.68 and prior to 10.0.8 have an incorrect r CVE-2023-341076.5GLPI is a free asset and IT management software package. Versions of the software starting with 9.2.0 and prior to 10.0.8 have an incorrect CVE-2023-341088.8mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI for user/server admin CVE-2023-341097.5zxcvbn-ts is an open source password strength estimator written in typescript. This vulnerability affects users running on the nodeJS platfo