CVE-2023-34099

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. This issue has been addressed in version 5.7.18 and users are advised to update. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-754

Affected software

No affected versions have been published.

Timeline

Published
Jun 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-34105.4The Bricks theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘customTag' attribute in versions up to, and including, CVE-2023-341006.5Contiki-NG is an open-source, cross-platform operating system for IoT devices. When reading the TCP MSS option value from an incoming packetCVE-2023-341019.1Contiki-NG is an operating system for internet of things devices. In version 4.8 and prior, when processing ICMP DAO packets in the `dao_inpCVE-2023-341028.8Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updatinCVE-2023-341035.4Avo is an open source ruby on rails admin panel creation framework. In affected versions some avo fields are vulnerable to Cross Site ScriptCVE-2023-341047.5fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaCVE-2023-341057.5SRS is a real-time video server supporting RTMP, WebRTC, HLS, HTTP-FLV, SRT, MPEG-DASH, and GB28181. Prior to versions 5.0.157, 5.0-b1, and CVE-2023-341066.5GLPI is a free asset and IT management software package. Versions of the software starting with 0.68 and prior to 10.0.8 have an incorrect rCVE-2023-341076.5GLPI is a free asset and IT management software package. Versions of the software starting with 9.2.0 and prior to 10.0.8 have an incorrect CVE-2023-341088.8mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI for user/server adminCVE-2023-341097.5zxcvbn-ts is an open source password strength estimator written in typescript. This vulnerability affects users running on the nodeJS platfoCVE-2023-34114.3The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in