CVE-2022-24879: shopware

csirt@kutim:~/threat-intel/cve/CVE-2022-24879

CVSS 7.5 · High EPSS 0,61%

Kerentanan Cross-Site Request Forgery (CSRF) pada shopware. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Shopware is an open source e-commerce software platform. Versions prior to 5.7.9 are vulnerable to malfunction of cross-site request forgery (CSRF) token validation. Under certain circumstances, the CSRF tokens were not generated anew and not validated correctly. This issue is fixed in version 5.7.9. Users of older versions may attempt to mitigate the vulnerability by using the Shopware security plugin.

Rincian

Terbit di NVD: 28 April 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-352: Cross-Site Request Forgery (CSRF)
EPSS (30 hari): 0,61% peluang dieksploitasi; lebih tinggi dari 47,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
shopware	shopware	Versi 5.2.0 hingga sebelum 5.7.9

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022 advisory vendor
https://www.shopware.com/en/changelog-sw5/#5-7-9 release notes · advisory vendor
https://github.com/shopware/shopware/security/advisories/GHSA-pf38-v6qj-j23h advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.