Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1naDY2LWZwN2otOTh2Nc4AA0IL

Shopware improper mail validation vulnerability

Impact

The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts.

Patches

We recommend updating to the current version 5.7.18. You can get the update to 5.7.18 regularly via the Auto-Updater or directly via the release page. https://github.com/shopware5/shopware/releases/tag/v5.7.18

For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

References

https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023

Permalink: https://github.com/advisories/GHSA-gh66-fp7j-98v5
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1naDY2LWZwN2otOTh2Nc4AA0IL
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 3 months ago
Updated: 3 months ago

CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Identifiers: GHSA-gh66-fp7j-98v5, CVE-2023-34099
References:

• https://github.com/shopware/shopware/security/advisories/GHSA-gh66-fp7j-98v5
• https://github.com/shopware5/shopware/security/advisories/GHSA-gh66-fp7j-98v5
• https://nvd.nist.gov/vuln/detail/CVE-2023-34099
• https://github.com/shopware5/shopware/commit/39cc714d9a0be33b43877044d0b88ea3c6b43f3d
• https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023
• https://www.shopware.com/en/changelog-sw5/#5-7-18
• https://github.com/advisories/GHSA-gh66-fp7j-98v5

Affected Packages