CVE-2024-22407: Shopware is an open headless commerce platform. In the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions…

PriorityP335medium6.5CVSS 3.1

AVNACLPRLUINSUCNIHAN

EPSS

0.40%

32.2th percentile

Shopware is an open headless commerce platform. In the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions that modify the payment, delivery, and/or order status. Due to this inadequate implementation, users lacking 'write' permissions for orders are still able to change the order state. This issue has been addressed and users are advised to update to Shopware 6.5.7.4. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
shopware	core	>= 0 < 6.5.7.4	6.5.7.4
shopware	platform	>= 0 < 6.5.7.4	6.5.7.4
shopware	shopware	< 6.5.7.4	6.5.7.4

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.