CVE-2023-22730

Katalog CVE

CVSS 7.5 · High EPSS 0,66%

Kerentanan Improper Input Validation pada shopware. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions It was possible to put the same line item multiple times in the cart using the AP. The Cart Validators checked the line item's individuality and the user was able to bypass quantity limits in sales. This problem has been fixed with version 6.4.18.1. Users on major versions 6.1, 6.2, and 6.3 may also obtain this fix via a plugin.

Rincian

Terbit di NVD

17 Januari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

0,66% peluang dieksploitasi; lebih tinggi dari 50,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates patch · advisory vendor
• https://github.com/shopware/platform/commit/4fce12096e54b2033832d9104fa2e68888c2b4e9 patch · advisory pihak ketiga
• https://github.com/shopware/platform/security/advisories/GHSA-8r6h-m72v-38fg advisory pihak ketiga