Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/15631?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/15631?format=api", "vulnerability_id": "VCID-8n77-xfpc-sucm", "summary": "Cross-Site Request Forgery (CSRF)\nShopware is an open source e-commerce software platform. Versions prior to 5.7.9 is vulnerable to malfunction of cross-site request forgery (CSRF) token validation. Under certain circumstances, the CSRF tokens were not generated anew and not validated correctly. This issue is fixed in version 5.7.9. Users of older versions may attempt to mitigate the vulnerability by using the Shopware security plugin.", "aliases": [ { "alias": "CVE-2022-24879" }, { "alias": "GHSA-pf38-v6qj-j23h" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/57696?format=api", "purl": "pkg:composer/shopware/core@6.1.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-5393-j7pp-tqa2" }, { "vulnerability": "VCID-s891-7fx6-k7e8" }, { "vulnerability": "VCID-wdc4-uy1a-ybec" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/shopware/core@6.1.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/57699?format=api", "purl": "pkg:composer/shopware/platform@6.1.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-5393-j7pp-tqa2" }, { "vulnerability": "VCID-s891-7fx6-k7e8" }, { "vulnerability": "VCID-wdc4-uy1a-ybec" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/shopware/platform@6.1.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/60549?format=api", "purl": "pkg:composer/shopware/shopware@5.7.9", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/shopware/shopware@5.7.9" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/60552?format=api", "purl": "pkg:composer/shopware/core@5.2.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-8n77-xfpc-sucm" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/shopware/core@5.2.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/60545?format=api", "purl": "pkg:composer/shopware/platform@5.2.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-8n77-xfpc-sucm" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/shopware/platform@5.2.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/53868?format=api", "purl": "pkg:composer/shopware/shopware@5.2.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2xvz-338c-dygp" }, { "vulnerability": "VCID-8n77-xfpc-sucm" }, { "vulnerability": "VCID-c8p5-grny-sue7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/shopware/shopware@5.2.0" } ], "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-24879", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00135", "scoring_system": "epss", "scoring_elements": "0.3314", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-24879" }, { "reference_url": "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022" }, { "reference_url": "https://www.shopware.com/en/changelog-sw5/#5-7-9", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.shopware.com/en/changelog-sw5/#5-7-9" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24879", "reference_id": "CVE-2022-24879", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24879" }, { "reference_url": "https://github.com/advisories/GHSA-pf38-v6qj-j23h", "reference_id": "GHSA-pf38-v6qj-j23h", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-pf38-v6qj-j23h" }, { "reference_url": "https://github.com/shopware/shopware/security/advisories/GHSA-pf38-v6qj-j23h", "reference_id": "GHSA-pf38-v6qj-j23h", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/shopware/shopware/security/advisories/GHSA-pf38-v6qj-j23h" } ], "weaknesses": [ { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." }, { "cwe_id": 352, "name": "Cross-Site Request Forgery (CSRF)", "description": "The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." } ], "exploits": [], "severity_range_score": "7.0 - 8.9", "exploitability": null, "weighted_severity": null, "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-8n77-xfpc-sucm" }