GHSA-q3g4-2vw9-xv27

Source

https://github.com/advisories/GHSA-q3g4-2vw9-xv27

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-q3g4-2vw9-xv27/GHSA-q3g4-2vw9-xv27.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-q3g4-2vw9-xv27

Published

2024-05-21T18:50:07Z

Modified

2024-12-06T05:38:17Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Shopware Remote Code Execution Vulnerability

Details

Under certain circumstances, it’s possible to execute an unauthorized foreign code in Shopware. This is a critical security vulnerability that could affect the entire system. All Shopware versions including Shopware 5.2.14 are affected.

Database specific

{
    "cwe_ids":  [
        "CWE-74"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-05-21T18:50:07Z",
    "nvd_published_at":  null,
    "severity":  "CRITICAL"
}

References

Affected packages

Packagist / shopware/shopware

Package

Name: shopware/shopware
Purl: pkg:composer/shopware/shopware

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.0.0

Fixed

5.2.15

Affected versions

4.*

4.2.0-rc.1

4.2.0

4.2.1

4.2.1.1

4.2.2

4.2.3

4.3.0

4.3.1

4.3.2

4.3.3

4.3.4

4.3.5

4.3.6

4.3.7

v5.*

v5.0.0-BETA1

v5.0.0-BETA2

v5.0.0-RC1

v5.0.0-RC2

v5.0.0-RC3

v5.0.0

v5.0.1

v5.0.2-RC1

v5.0.2

v5.0.3-RC1

v5.0.3

v5.0.4-RC1

v5.0.4

v5.1.0-RC2

v5.1.0-RC3

v5.1.0

v5.1.1

v5.1.2-RC1

v5.1.2-RC2

v5.1.2

v5.1.3-RC1

v5.1.3

v5.1.4

v5.1.5

v5.1.6

v5.2.0-BETA1

v5.2.0-RC1

v5.2.0-RC2

v5.2.0-RC3

v5.2.0

v5.2.1

v5.2.2

v5.2.3

v5.2.4

v5.2.5

v5.2.6

v5.2.7

v5.2.8

v5.2.9

v5.2.10

v5.2.11

v5.2.12

v5.2.13

v5.2.14

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-q3g4-2vw9-xv27/GHSA-q3g4-2vw9-xv27.json"