5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
44.6%
The request for the customer detail view in the backend administration contained sensitive data like the hashed password and the session ID.
We recommend updating to the current version 5.7.15. You can get the update to 5.7.15 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/changelog-sw5/#5-7-15
For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-09-2022
CPE | Name | Operator | Version |
---|---|---|---|
shopware/shopware | le | 5.7.14 |
docs.shopware.com/en/shopware-5-en/security-updates/security-update-09-2022
github.com/advisories/GHSA-6vfq-jmxg-g58r
github.com/shopware/shopware/commit/af5cdbc81d60f21b728e1433aeb8837f25938d2a
github.com/shopware/shopware/security/advisories/GHSA-6vfq-jmxg-g58r
nvd.nist.gov/vuln/detail/CVE-2022-36101
packagist.org/packages/shopware/shopware