CVE-2024-42355
Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and allows execution of code.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.86%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Shopware, an open ecommerce platform, has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag. Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and allows execution of code. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.86% probability · 57th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-1336, CWE-94
- Affected
- shopware/shopware
- Source
- security-advisories@github.com
References
- https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442fPatch
- https://github.com/shopware/core/commit/d35ee2eda5c995faeb08b3dad127eab65c64e2a2Patch
- https://github.com/shopware/shopware/commit/445c6763cc093fbd651e0efaa4150deae4ae60daPatch
- https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0acPatch
- https://github.com/shopware/shopware/security/advisories/GHSA-27wp-jvhw-v4xpVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.