CVE-2022-24871

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-24871
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-24871.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-24871
Aliases
Published
2022-04-20T19:05:11Z
Modified
2026-02-21T02:51:52.960627Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Server-Side Request Forgery (SSRF) in Shopware
Details

Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the Admin SDK functionality on the server to read or update internal resources. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24871.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ]
}
References

Affected packages

Git / github.com/shopware/platform

Affected ranges

Type
GIT
Repo
https://github.com/shopware/platform
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cabe8ec825a787f72c2222dbe529fa7e1fd6ebfb
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.4.10.1"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-24871.json"

Git / github.com/shopware/shopware

Affected ranges

Type
GIT
Repo
https://github.com/shopware/shopware
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cabe8ec825a787f72c2222dbe529fa7e1fd6ebfb

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-24871.json"