CVE-2024-42355
08.08.2024, 15:15
Shopware, an open ecommerce platform, has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag. Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and allows execution of code. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin.
| Vendor | Product | Version |
|---|---|---|
| shopware | shopware | 𝑥 < 6.5.8.13 |
| shopware | shopware | 6.6.0.0 ≤ 𝑥 < 6.6.5.1 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template EngineThe product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
- CWE-94 - Improper Control of Generation of Code ('Code Injection')The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
References