GHSA-qc43-pgwq-3q2q
Suggest an improvement- Source
- https://github.com/advisories/GHSA-qc43-pgwq-3q2q
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-qc43-pgwq-3q2q/GHSA-qc43-pgwq-3q2q.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-qc43-pgwq-3q2q
- Aliases
-
- CVE-2022-36102
- Published
- 2022-09-16T21:01:29Z
- Modified
- 2023-11-08T04:10:01.167639Z
- Severity
-
- 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
- Summary
- Shopware access control list bypassed via crafted specific URLs
- Details
-
Impact
If backend admin controllers are called with a certain notation, the ACL could be bypassed. Users could execute actions, which they are normally not able to do.
Patches
We recommend updating to the current version 5.7.15. You can get the update to 5.7.15 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/changelog-sw5/#5-7-15
For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html
References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-09-2022
- Database specific
{ "nvd_published_at": "2022-09-12T20:15:00Z", "github_reviewed_at": "2022-09-16T21:01:29Z", "severity": "MODERATE", "github_reviewed": true, "cwe_ids": [ "CWE-281" ] }- References
-
- https://github.com/shopware/shopware/security/advisories/GHSA-qc43-pgwq-3q2q
- https://nvd.nist.gov/vuln/detail/CVE-2022-36102
- https://github.com/shopware/shopware/commit/de92d3a78279119a5bbe203054f8fa1d25126af6
- https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-09-2022
- https://github.com/shopware/shopware
- https://packagist.org/packages/shopware/shopware
Affected packages
Packagist / shopware/shopware
Package
- Name
- shopware/shopware
- Purl
- pkg:composer/shopware/shopware
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed5.7.15
Affected versions
1.*
1.0.2
1.0.8
4.*
4.2.0-rc.1
4.2.0
4.2.1
4.2.1.1
4.2.2
4.2.3
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
v5.*
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.0-RC3
v5.0.0
v5.0.1
v5.0.2-RC1
v5.0.2
v5.0.3-RC1
v5.0.3
v5.0.4-RC1
v5.0.4
v5.1.0-RC2
v5.1.0-RC3
v5.1.0
v5.1.1
v5.1.2-RC1
v5.1.2-RC2
v5.1.2
v5.1.3-RC1
v5.1.3
v5.1.4
v5.1.5
v5.1.6
v5.2.0-BETA1
v5.2.0-RC1
v5.2.0-RC2
v5.2.0-RC3
v5.2.0
v5.2.1
v5.2.2
v5.2.3
v5.2.4
v5.2.5
v5.2.6
v5.2.7
v5.2.8
v5.2.9
v5.2.10
v5.2.11
v5.2.12
v5.2.13
v5.2.14
v5.2.15
v5.2.16
v5.2.17
v5.2.18
v5.2.19
v5.2.20
v5.2.21
v5.2.22
v5.2.23
v5.2.24
v5.2.25
v5.2.26
v5.2.27
v5.3.4
v5.3.5
v5.3.6
v5.3.7
v5.4.0-RC1
v5.4.0
v5.4.1
v5.4.2
v5.4.3
v5.4.4
v5.4.5
v5.4.6
v5.5.0-BETA1
v5.5.0-RC1
v5.5.0
v5.5.1
v5.5.2
v5.5.3
v5.5.4
v5.5.5
v5.5.6
v5.5.7
v5.5.8
v5.5.9
v5.5.10
v5.6.0-RC1
v5.6.0
v5.6.1
v5.6.2
v5.6.3
v5.6.4
v5.6.5
v5.6.6
v5.6.7
v5.6.8
v5.6.9
v5.6.10
v5.7.0-RC1
v5.7.0-RC2
v5.7.0
v5.7.1
v5.7.2
v5.7.3
v5.7.4
v5.7.5
v5.7.6
v5.7.7
v5.7.8
v5.7.9
v5.7.10
v5.7.11
v5.7.12
v5.7.13
v5.7.14
5.*
5.3.0