VulnerabilityModified

CVE-2024-22407

Shopware is an open headless commerce platform.

MEDIUM 6.5EPSS 0.40%

Does this matter?

Lower severity and a low EPSS score (0.40%). Track it; it rarely justifies an emergency change on its own.

Description

Shopware is an open headless commerce platform. In the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions that modify the payment, delivery, and/or order status. Due to this inadequate implementation, users lacking 'write' permissions for orders are still able to change the order state. This issue has been addressed and users are advised to update to Shopware 6.5.7.4. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS: 0.40% probability · 34th percentile
CISA KEV: Not listed
Weakness: CWE-284
Affected: shopware/shopware
Source: security-advisories@github.com

References

https://github.com/shopware/shopware/security/advisories/GHSA-3867-jc5c-66qfVendor Advisory
https://github.com/shopware/shopware/security/advisories/GHSA-3867-jc5c-66qfVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.