Improper Access Control in Shopware

CAO 8.1CVE-2022-24872 · GHSA-9wrv-g75h-8ccc · Công bố 20/04/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2022-24872 là lỗ hổng mức CAO (CVSS 8.1) ảnh hưởng shopware/core, shopware/platform, shopware (shopware).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.1%, cao hơn 64.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 6.4.10.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
shopware/core Packagist	`< 6.4.10.1`	`6.4.10.1`
shopware/platform Packagist	`< 6.4.10.1`	`6.4.10.1`
shopware shopware	`< 6.4.10.1`	`6.4.10.1`

Mô tả

Shopware 6 is an open commerce platform based on Symfony Framework and Vue and supported by a worldwide community and more than 1.500 community extensions. Permissions set to sales channel context by admin-api are still useable within normal user session. We recommend updating to the current version 6.4.10.1. You can get the update to 6.4.10.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Mô tả của NVD

Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by admin-api are still usable within normal user session. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue.