Kurz gesagt
- CVE-2024-42355 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in shopware/core, shopware/platform, shopware (shopware).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.86%, höher als bei 58.6% aller Schwachstellen.
- Abhilfe: auf 6.6.5.1, 6.5.8.13 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| shopware/core Packagist | ≥ 6.6.0.0, < 6.6.5.1< 6.5.8.13
| 6.6.5.16.5.8.13
|
| shopware/platform Packagist | ≥ 6.6.0.0, < 6.6.5.1< 6.5.8.13
| 6.6.5.16.5.8.13
|
| shopware | ≥ 6.6.0.0, < 6.6.5.1< 6.5.8.13
| 6.6.5.16.5.8.13
|
Description
Impact
Shopware has a new Twig Tag sw_silent_feature_call which silences deprecation messages while triggered in this tag.
It accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and allows execution of code.
Patches
Update to Shopware 6.6.5.1 or 6.5.8.13
Workarounds
For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
NVD description
Shopware, an open ecommerce platform, has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag. Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and allows execution of code. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free