Lookup for vulnerable packages by Package URL.
| Purl | pkg:composer/shopware/shopware@5.7.12 |
|---|
| Type | composer |
|---|
| Namespace | shopware |
|---|
| Name | shopware |
|---|
| Version | 5.7.12 |
|---|
| Qualifiers |
|
|---|
| Subpath | |
|---|
| Is_vulnerable | true |
|---|
| Next_non_vulnerable_version | 5.7.18 |
|---|
| Latest_non_vulnerable_version | 6.7.2+1 |
|---|
| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-d3za-bchr-uycm |
| vulnerability_id |
VCID-d3za-bchr-uycm |
| summary |
Shopware is an open source e-commerce software. In affected versions if backend admin controllers are called with a certain notation, the ACL could be bypassed. Users could execute actions, which they are normally not able to do. Users are advised to update to the current version (5.7.15). Users can get the update via the Auto-Updater or directly via the download overview. There are no known workarounds for this issue. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2022-36102, GHSA-qc43-pgwq-3q2q
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-d3za-bchr-uycm |
|
| 1 |
| url |
VCID-h296-uh2x-6kfn |
| vulnerability_id |
VCID-h296-uh2x-6kfn |
| summary |
Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. This issue has been addressed in version 5.7.18 and users are advised to update. There are no known workarounds for this vulnerability. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2023-34099, GHSA-gh66-fp7j-98v5
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-h296-uh2x-6kfn |
|
| 2 |
| url |
VCID-s33d-ab46-y7an |
| vulnerability_id |
VCID-s33d-ab46-y7an |
| summary |
Shopware is an open source e-commerce software. Due to an incorrect configuration in the `.htaccess` file, the configuration file of the Javascript could be read in production environments (`themes/package-lock.json`). With this information, the specific Shopware version in a deployment might be determined by an attacker, which could be used for further attacks. Users are advised to update to version 5.7.18. There are no known workarounds for this vulnerability. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2023-34098, GHSA-q97c-2mh3-pgw9
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-s33d-ab46-y7an |
|
| 3 |
| url |
VCID-u5yn-sd89-qfhy |
| vulnerability_id |
VCID-u5yn-sd89-qfhy |
| summary |
Shopware is an open source e-commerce software. In affected versions the request for the customer detail view in the backend administration contained sensitive data like the hashed password and the session ID. These fields are now explicitly unset in version 5.7.15. Users are advised to update and may get the update either via the Auto-Updater or directly via the download overview. There are no known workarounds for this issue. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2022-36101, GHSA-6vfq-jmxg-g58r
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-u5yn-sd89-qfhy |
|
|
|---|
| Fixing_vulnerabilities |
| 0 |
| url |
VCID-7yxt-j9gh-1udq |
| vulnerability_id |
VCID-7yxt-j9gh-1udq |
| summary |
Shopware is an open source e-commerce software made in Germany. Versions of Shopware 5 prior to version 5.7.12 are subject to an authenticated Stored XSS in Administration. Users are advised to upgrade. There are no known workarounds for this issue. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
| reference_url |
https://packagist.org/packages/shopware/shopware |
| reference_id |
shopware |
| reference_type |
|
| scores |
| 0 |
| value |
5.4 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
6.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 3 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T14:04:38Z/ |
|
|
| url |
https://packagist.org/packages/shopware/shopware |
|
|
| fixed_packages |
|
| aliases |
CVE-2022-31057, GHSA-q754-vwc4-p6qj
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-7yxt-j9gh-1udq |
|
|
|---|
| Risk_score | null |
|---|
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:composer/shopware/shopware@5.7.12 |
|---|