Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-5bhg-9kzp-tqcb
Vulnerability ID VCID-5bhg-9kzp-tqcb
Aliases CVE-2024-42354
GHSA-hhcq-ph6w-494g
Summary Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api ### Impact The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON. The processing of the Criteria did not considered ManyToMany associations and so they were not considered properly and the protections didn't get used. This issue cannot be reproduced with the default entities by Shopware, but can be triggered with extensions. ### Patches Update to Shopware 6.6.5.1 or 6.5.8.13. ### Workarounds For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-284 Improper Access Control
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00424 https://api.first.org/data/v1/epss?cve=CVE-2024-42354
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-hhcq-ph6w-494g
cvssv3.1 5.3 https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f
cvssv4 5.9 https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f
generic_textual MODERATE https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f
ssvc Track https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f
cvssv3.1 5.3 https://github.com/shopware/core/commit/d35ee2eda5c995faeb08b3dad127eab65c64e2a2
cvssv4 5.9 https://github.com/shopware/core/commit/d35ee2eda5c995faeb08b3dad127eab65c64e2a2
generic_textual MODERATE https://github.com/shopware/core/commit/d35ee2eda5c995faeb08b3dad127eab65c64e2a2
ssvc Track https://github.com/shopware/core/commit/d35ee2eda5c995faeb08b3dad127eab65c64e2a2
cvssv3.1 5.3 https://github.com/shopware/shopware
cvssv4 5.9 https://github.com/shopware/shopware
generic_textual MODERATE https://github.com/shopware/shopware
cvssv3.1 5.3 https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac
cvssv4 5.9 https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac
generic_textual MODERATE https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac
ssvc Track https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac
cvssv3.1 5.3 https://github.com/shopware/shopware/commit/ad83d38809df457efef21c37ce0996430334bf01
cvssv4 5.9 https://github.com/shopware/shopware/commit/ad83d38809df457efef21c37ce0996430334bf01
generic_textual MODERATE https://github.com/shopware/shopware/commit/ad83d38809df457efef21c37ce0996430334bf01
ssvc Track https://github.com/shopware/shopware/commit/ad83d38809df457efef21c37ce0996430334bf01
cvssv3.1 5.3 https://github.com/shopware/shopware/security/advisories/GHSA-hhcq-ph6w-494g
cvssv3.1_qr MODERATE https://github.com/shopware/shopware/security/advisories/GHSA-hhcq-ph6w-494g
cvssv4 5.9 https://github.com/shopware/shopware/security/advisories/GHSA-hhcq-ph6w-494g
generic_textual MODERATE https://github.com/shopware/shopware/security/advisories/GHSA-hhcq-ph6w-494g
ssvc Track https://github.com/shopware/shopware/security/advisories/GHSA-hhcq-ph6w-494g
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2024-42354
cvssv4 5.9 https://nvd.nist.gov/vuln/detail/CVE-2024-42354
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2024-42354
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-42354
https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f
https://github.com/shopware/core/commit/d35ee2eda5c995faeb08b3dad127eab65c64e2a2
https://github.com/shopware/shopware
https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac
https://github.com/shopware/shopware/commit/ad83d38809df457efef21c37ce0996430334bf01
https://github.com/shopware/shopware/security/advisories/GHSA-hhcq-ph6w-494g
https://nvd.nist.gov/vuln/detail/CVE-2024-42354
GHSA-hhcq-ph6w-494g https://github.com/advisories/GHSA-hhcq-ph6w-494g
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-08T15:24:16Z/ Found at https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://github.com/shopware/core/commit/d35ee2eda5c995faeb08b3dad127eab65c64e2a2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/shopware/core/commit/d35ee2eda5c995faeb08b3dad127eab65c64e2a2
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-08T15:24:16Z/ Found at https://github.com/shopware/core/commit/d35ee2eda5c995faeb08b3dad127eab65c64e2a2
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://github.com/shopware/shopware
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/shopware/shopware
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-08T15:24:16Z/ Found at https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://github.com/shopware/shopware/commit/ad83d38809df457efef21c37ce0996430334bf01
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/shopware/shopware/commit/ad83d38809df457efef21c37ce0996430334bf01
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-08T15:24:16Z/ Found at https://github.com/shopware/shopware/commit/ad83d38809df457efef21c37ce0996430334bf01
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://github.com/shopware/shopware/security/advisories/GHSA-hhcq-ph6w-494g
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/shopware/shopware/security/advisories/GHSA-hhcq-ph6w-494g
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-08T15:24:16Z/ Found at https://github.com/shopware/shopware/security/advisories/GHSA-hhcq-ph6w-494g
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-42354
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-42354
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.6246
EPSS Score 0.00424
Published At May 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-29T08:44:41.583627+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/08/GHSA-hhcq-ph6w-494g/GHSA-hhcq-ph6w-494g.json 38.6.0