CVE-2022-36102

Shopware is an open source e-commerce software. In affected versions if backend admin controllers are called with a certain notation, the ACL could be bypassed. Users could execute actions, which they are normally not able to do. Users are advised to update to the current version (5.7.15). Users can get the update via the Auto-Updater or directly via the download overview. There are no known workarounds for this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
GitHub_MCNA
6.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 18%
VendorProductVersion
shopwareshopware
5.0.0 ≤
𝑥
< 5.7.15
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-09-2022
https://github.com/shopware/shopware/commit/de92d3a78279119a5bbe203054f8fa1d25126af6
https://github.com/shopware/shopware/security/advisories/GHSA-qc43-pgwq-3q2q
https://packagist.org/packages/shopware/shopware
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-09-2022
https://github.com/shopware/shopware/commit/de92d3a78279119a5bbe203054f8fa1d25126af6
https://github.com/shopware/shopware/security/advisories/GHSA-qc43-pgwq-3q2q
https://packagist.org/packages/shopware/shopware