CVE-2023-22734 — Improper Input Validation in Platform

CWE-20 — Improper Input Validation3 documents3 sources
Severity
7.5HIGHNVD
EPSS
0.3%
top 46.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Shopware PlatformShopwareShopware Core
Timeline
PublishedJan 17
Latest updateJan 20

Description

Shopware is an open source commerce platform based on Symfony Framework and Vue js. The newsletter double opt-in validation was not checked properly, and it was possible to skip the complete double opt in process. As a result operators may have inconsistencies in their newsletter systems. This problem has been fixed with version 6.4.18.1. Users are advised to upgrade. Users unable to upgrade may find security measures are available via a plugin for major versions 6.1, 6.2, and 6.3. Users may als…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5shopware/platform< 6.4.18.1
▶Packagistshopware/platform< 6.4.18.1
▶Packagistshopware/core< 6.4.18.1
▶NVDshopware/shopware< 6.4.18.1

Patches

Patch: docs.shopware.com ↗Patch: github.com ↗Patch: docs.shopware.com ↗

🔴Vulnerability Details

2
OSV
Shopware has Improper Input Validation issue in newsletter subscription↗2023-01-20
▶
GHSA
Shopware has Improper Input Validation issue in newsletter subscription↗2023-01-20
▶