CVE-2024-22407

2024-01-1623:15:08

CWE-284

[email protected]

web.nvd.nist.gov

shopware

cms

authorization

verification

order state

modification

security update

vulnerability

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

0.0005 Low

EPSS

Percentile

16.2%

JSON

Shopware is an open headless commerce platform. In the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions that modify the payment, delivery, and/or order status. Due to this inadequate implementation, users lacking ‘write’ permissions for orders are still able to change the order state. This issue has been addressed and users are advised to update to Shopware 6.5.7.4. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Affected configurations

Vulners

NVD

Node

shopwareshopwareRange<6.5.7.4

VendorProductVersionCPE
shopwareshopware*cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
shopware	shopware	*	cpe:2.3:a:shopware:shopware::::::::

CNA Affected

[
  {
    "vendor": "shopware",
    "product": "shopware",
    "versions": [
      {
        "version": "<  6.5.7.4",
        "status": "affected"
      }
    ]
  }
]