CVE-2022-24871 - Vulnerability Details - OpenCVE

Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the Admin SDK functionality on the server to read or update internal resources. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Shopware	Shopware

Configuration 1 [-]

cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022
https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77c
https://github.com/shopware/platform/security/advisories/GHSA-7gm7-8q8v-9gf2

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2022-04-20T19:05:11

Updated: 2024-08-03T04:29:00.197Z

Reserved: 2022-02-10T00:00:00

Link: CVE-2022-24871

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-04-20T19:15:08.093

Modified: 2024-11-21T06:51:17.483

Link: CVE-2022-24871

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "platform", "vendor": "shopware", "versions": [{"status": "affected", "version": "< 6.4.10.1"}]}], "descriptions": [{"lang": "en", "value": "Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the Admin SDK functionality on the server to read or update internal resources. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-04-20T19:05:11", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/shopware/platform/security/advisories/GHSA-7gm7-8q8v-9gf2"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77c"}, {"tags": ["x_refsource_MISC"], "url": "https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022"}], "source": {"advisory": "GHSA-7gm7-8q8v-9gf2", "discovery": "UNKNOWN"}, "title": "Server-Side Request Forgery (SSRF) in Shopware", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-24871", "STATE": "PUBLIC", "TITLE": "Server-Side Request Forgery (SSRF) in Shopware"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "platform", "version": {"version_data": [{"version_value": "< 6.4.10.1"}]}}]}, "vendor_name": "shopware"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the Admin SDK functionality on the server to read or update internal resources. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-918: Server-Side Request Forgery (SSRF)"}]}]}, "references": {"reference_data": [{"name": "https://github.com/shopware/platform/security/advisories/GHSA-7gm7-8q8v-9gf2", "refsource": "CONFIRM", "url": "https://github.com/shopware/platform/security/advisories/GHSA-7gm7-8q8v-9gf2"}, {"name": "https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77c", "refsource": "MISC", "url": "https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77c"}, {"name": "https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022", "refsource": "MISC", "url": "https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022"}]}, "source": {"advisory": "GHSA-7gm7-8q8v-9gf2", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T04:29:00.197Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/shopware/platform/security/advisories/GHSA-7gm7-8q8v-9gf2"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77c"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-24871", "datePublished": "2022-04-20T19:05:11", "dateReserved": "2022-02-10T00:00:00", "dateUpdated": "2024-08-03T04:29:00.197Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*", "matchCriteriaId": "D55965A4-CEC0-409A-88C0-EE94BE12B95A", "versionEndExcluding": "6.4.10.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the Admin SDK functionality on the server to read or update internal resources. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue."}, {"lang": "es", "value": "Shopware es una plataforma de comercio abierta basada en Symfony Framework y Vue. En las versiones afectadas un atacante puede abusar de la funcionalidad Admin SDK en el servidor para leer o actualizar recursos internos. Es recomendado a usuarios actualizar a la versi\u00f3n actual 6.4.10.1. Para las versiones anteriores de 6.1, 6.2 y 6.3, las medidas de seguridad correspondientes tambi\u00e9n est\u00e1n disponibles por medio de un plugin. No son conocidas medidas de mitigaci\u00f3n para este problema"}], "id": "CVE-2022-24871", "lastModified": "2024-11-21T06:51:17.483", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 5.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-04-20T19:15:08.093", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77c"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/shopware/platform/security/advisories/GHSA-7gm7-8q8v-9gf2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/shopware/platform/security/advisories/GHSA-7gm7-8q8v-9gf2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-918"}], "source": "nvd@nist.gov", "type": "Primary"}]}