CVE-2022-36102

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-36102
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36102.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-36102
Aliases
Published
2022-09-12T20:00:24Z
Modified
2025-10-21T02:36:04Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Acess control list bypassed via crafted specific URLs
Details

Shopware is an open source e-commerce software. In affected versions if backend admin controllers are called with a certain notation, the ACL could be bypassed. Users could execute actions, which they are normally not able to do. Users are advised to update to the current version (5.7.15). Users can get the update via the Auto-Updater or directly via the download overview. There are no known workarounds for this issue.

References

Affected packages

Git /

Affected ranges

Database specific

unresolved_versions

[
    {
        "type": "",
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "5.7.15"
            }
        ]
    }
]