CVE-2023-34098

27.06.2023, 17:15

Shopware is an open source e-commerce software. Due to an incorrect configuration in the `.htaccess` file, the configuration file of the Javascript could be read in production environments (`themes/package-lock.json`). With this information, the specific Shopware version in a deployment might be determined by an attacker, which could be used for further attacks. Users are advised to update to version 5.7.18. There are no known workarounds for this vulnerability.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Affected Products (NVD)

Vendor	Product	Version
shopware	shopware	5.6.0 ≤ 𝑥 < 5.7.18

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
shopware	shopware	𝑥 < 5.7.18	ADP

Common Weakness Enumeration

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References

https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023

https://github.com/shopware/shopware/security/advisories/GHSA-q97c-2mh3-pgw9

https://github.com/shopware5/shopware/commit/b3518c8d9562a38615d638f31f79829f6e2f4b6a

https://www.shopware.com/en/changelog-sw5/#5-7-18

https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023

https://github.com/shopware/shopware/security/advisories/GHSA-q97c-2mh3-pgw9

https://github.com/shopware5/shopware/commit/b3518c8d9562a38615d638f31f79829f6e2f4b6a

https://www.shopware.com/en/changelog-sw5/#5-7-18