CVE-2023-22734
published 2023-01-17CVE-2023-22734: Shopware is an open source commerce platform based on Symfony Framework and Vue js. The newsletter double opt-in validation was not checked properly, and it…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.60%
44.9th percentile
Shopware is an open source commerce platform based on Symfony Framework and Vue js. The newsletter double opt-in validation was not checked properly, and it was possible to skip the complete double opt in process. As a result operators may have inconsistencies in their newsletter systems. This problem has been fixed with version 6.4.18.1. Users are advised to upgrade. Users unable to upgrade may find security measures are available via a plugin for major versions 6.1, 6.2, and 6.3. Users may also disable newsletter registration completely.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| shopware | core | >= 0 < 6.4.18.1 | 6.4.18.1 |
| shopware | platform | < 6.4.18.1 | 6.4.18.1 |
| shopware | platform | >= 0 < 6.4.18.1 | 6.4.18.1 |
| shopware | shopware | < 6.4.18.1 | 6.4.18.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Shopware has Improper Input Validation issue in newsletter subscription
osv·2023-01-20
CVE-2023-22734 [MEDIUM] Shopware has Improper Input Validation issue in newsletter subscription
Shopware has Improper Input Validation issue in newsletter subscription
### Impact
The newsletter double opt-in validation was not checked properly, and it was possible to skip the complete double opt in process.
### Patches
The problem has been fixed with 6.4.18.1
### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. Or disable the newsletter registration completely.
### References
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates
GHSA
Shopware has Improper Input Validation issue in newsletter subscription
ghsa·2023-01-20
CVE-2023-22734 [MEDIUM] CWE-20 Shopware has Improper Input Validation issue in newsletter subscription
Shopware has Improper Input Validation issue in newsletter subscription
### Impact
The newsletter double opt-in validation was not checked properly, and it was possible to skip the complete double opt in process.
### Patches
The problem has been fixed with 6.4.18.1
### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. Or disable the newsletter registration completely.
### References
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updateshttps://github.com/shopware/platform/commit/f5a95ee2bcf1e546878450963ef1d9886e59a620https://github.com/shopware/platform/security/advisories/GHSA-46h7-vj7x-fxg2https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updateshttps://github.com/shopware/platform/commit/f5a95ee2bcf1e546878450963ef1d9886e59a620https://github.com/shopware/platform/security/advisories/GHSA-46h7-vj7x-fxg2
2023-01-17
Published