CVE-2022-24872

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-24872
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-24872.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-24872
Aliases
Published
2022-04-20T19:15:14Z
Modified
2026-02-24T11:42:55.985342Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Improper Access Control in shopware
Details

Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by admin-api are still usable within normal user session. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24872.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-732"
    ]
}
References

Affected packages

Git / github.com/shopware/platform

Affected ranges

Type
GIT
Repo
https://github.com/shopware/platform
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cabe8ec825a787f72c2222dbe529fa7e1fd6ebfb
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.4.10.1"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-24872.json"

Git / github.com/shopware/shopware

Affected ranges

Type
GIT
Repo
https://github.com/shopware/shopware
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
083765e2d64a00315050c4891800c9e98ba0c77c

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-24872.json"