CVE-2024-22406

Shopware is an open headless commerce platform. The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the “aggregations” object. The ‘name’ field in this “aggregations” object is vulnerable SQL-injection and can be exploited using time-based SQL-queries. This issue has been addressed and users are advised to update to Shopware 6.5.7.4. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/shopware/shopware/security/advisories/GHSA-qmp9-2xwj-m6m9	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-01-16 23:15

Updated : 2024-01-24 17:04

NVD link : CVE-2024-22406

Mitre link : CVE-2024-22406

CVE.ORG link : CVE-2024-22406

JSON object : View

Products Affected

shopware

shopware

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2024-22406", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 3.9}]}, "published": "2024-01-16T23:15:08.233", "references": [{"url": "https://github.com/shopware/shopware/security/advisories/GHSA-qmp9-2xwj-m6m9", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Shopware is an open headless commerce platform. The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the \u201caggregations\u201d object. The \u2018name\u2019 field in this \u201caggregations\u201d object is vulnerable SQL-injection and can be exploited using time-based SQL-queries. This issue has been addressed and users are advised to update to Shopware 6.5.7.4. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version."}, {"lang": "es", "value": "Shopware es una plataforma de comercio abierta y sin cabeza. La API de la aplicaci\u00f3n Shopware contiene una funci\u00f3n de b\u00fasqueda que permite a los usuarios buscar informaci\u00f3n almacenada en su instancia de Shopware. Las b\u00fasquedas realizadas por esta funci\u00f3n se pueden agregar utilizando los par\u00e1metros del objeto \u201caggregations\u201d. El campo 'name' en este objeto de \"aggregations\" es vulnerable a una inyecci\u00f3n SQL y puede explotarse mediante consultas SQL basadas en tiempo. Este problema se solucion\u00f3 y se recomienda a los usuarios que actualicen a Shopware 6.5.7.4. Para versiones anteriores de 6.1, 6.2, 6.3 y 6.4, las medidas de seguridad correspondientes tambi\u00e9n est\u00e1n disponibles a trav\u00e9s de un complemento. Para obtener la gama completa de funciones, recomendamos actualizar a la \u00faltima versi\u00f3n de Shopware."}], "lastModified": "2024-01-24T17:04:06.093", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0B083B7F-D749-44B1-8C9C-2A28013E210E", "versionEndExcluding": "6.5.7.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}