GHSA-4g29-fccr-p59w

Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-4g29-fccr-p59w/GHSA-4g29-fccr-p59w.json
Aliases
  • CVE-2022-24873
Published
2022-04-28T20:59:24Z
Modified
2022-09-22T03:57:09.605271Z
Details

Impact

Not-stored XSS in storefront. Request parameter were directly assigned to the template, so that malicious code could be send via an URL.

Patches

We recommend updating to the current version 5.7.9. You can get the update to 5.7.9 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/changelog-sw5/#5-7-9

For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

References

https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022

References

Affected packages

Packagist / shopware/shopware

shopware/shopware

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0
Fixed
5.7.9

Affected versions

1.*

1.0.2
1.0.8

4.*

4.2.0
4.2.0-rc.1
4.2.1
4.2.1.1
4.2.2
4.2.3
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7

5.*

5.3.0

v5.*

v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.0-RC3
v5.0.1
v5.0.2
v5.0.2-RC1
v5.0.3
v5.0.3-RC1
v5.0.4
v5.0.4-RC1
v5.1.0
v5.1.0-RC2
v5.1.0-RC3
v5.1.1
v5.1.2
v5.1.2-RC1
v5.1.2-RC2
v5.1.3
v5.1.3-RC1
v5.1.4
v5.1.5
v5.1.6
v5.2.0
v5.2.0-BETA1
v5.2.0-RC1
v5.2.0-RC2
v5.2.0-RC3
v5.2.1
v5.2.10
v5.2.11
v5.2.12
v5.2.13
v5.2.14
v5.2.15
v5.2.16
v5.2.17
v5.2.18
v5.2.19
v5.2.2
v5.2.20
v5.2.21
v5.2.22
v5.2.23
v5.2.24
v5.2.25
v5.2.26
v5.2.27
v5.2.3
v5.2.4
v5.2.5
v5.2.6
v5.2.7
v5.2.8
v5.2.9
v5.3.4
v5.3.5
v5.3.6
v5.3.7
v5.4.0
v5.4.0-RC1
v5.4.1
v5.4.2
v5.4.3
v5.4.4
v5.4.5
v5.4.6
v5.5.0
v5.5.0-BETA1
v5.5.0-RC1
v5.5.1
v5.5.10
v5.5.2
v5.5.3
v5.5.4
v5.5.5
v5.5.6
v5.5.7
v5.5.8
v5.5.9
v5.6.0
v5.6.0-RC1
v5.6.1
v5.6.10
v5.6.2
v5.6.3
v5.6.4
v5.6.5
v5.6.6
v5.6.7
v5.6.8
v5.6.9
v5.7.0
v5.7.0-RC1
v5.7.0-RC2
v5.7.1
v5.7.2
v5.7.3
v5.7.4
v5.7.5
v5.7.6
v5.7.7
v5.7.8