Reflected Cross-site Scripting in Shopware storefront

中 6.1CVE-2022-24873 · GHSA-4g29-fccr-p59w · 28/04/2022 公開 · 17/06/2026 更新

要点

CVE-2022-24873 は shopware/shopware, shopware (shopware) に影響する深刻度「中」 (CVSS 6.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.79%（全脆弱性の 56.3% より高い）。
対処：5.7.9 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
shopware/shopware Packagist	`< 5.7.9`	`5.7.9`
shopware shopware	`≥ 5.0.0, < 5.7.9`	`5.7.9`

概要

Impact

Not-stored XSS in storefront. Request parameter were directly assigned to the template, so that malicious code could be send via an URL.

Patches

We recommend updating to the current version 5.7.9. You can get the update to 5.7.9 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/changelog-sw5/#5-7-9

For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

References

https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022

NVD の説明

Shopware is an open source e-commerce software platform. Prior to version 5.7.9, Shopware is vulnerable to non-stored cross-site scripting in the storefront. This issue is fixed in version 5.7.9. Users of older versions may attempt to mitigate the vulnerability by using the Shopware security plugin.