Vulnerability in Shopware
CVE-2024-42354
Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON. Prior to versions 6.6.5.1 and 6.5.8.13, the processing of the Criteria did not considered ManyToMany associations and so they were not considered properly and the protections didn't get used. This issue cannot be reproduced with the default entities by Shopware, but can be triggered with extensions. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (34.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 35th percentile — 34.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Shopware — versions <= 6.5.8.12, >= 6.6.0.0, <= 6.6.5.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/shopware/shopware/security/advisories/GHSA-hhcq-ph6w-494g (Vendor Advisory)
- github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f (Patch)
- github.com/shopware/core/commit/d35ee2eda5c995faeb08b3dad127eab65c64e2a2 (Patch)
- github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac (Patch)
- github.com/shopware/shopware/commit/ad83d38809df457efef21c37ce0996430334bf01 (Patch)
Frequently asked questions
- What is CVE-2024-42354?
- CVE-2024-42354 is a medium-severity vulnerability in Shopware, classified under Improper Access Control. CVSS score: 5.3/10. Published 2024-08-08.
- How severe is CVE-2024-42354?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2024-42354 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.