CVE-2022-24872

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-24872

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-24872.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2022-24872

Aliases

GHSA-9wrv-g75h-8ccc

Published

2022-04-20T19:15:14Z

Modified

2025-12-02T23:38:36.337371Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

Improper Access Control in shopware

Details

Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by admin-api are still usable within normal user session. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24872.json",
    "cwe_ids": [
        "CWE-732"
    ]
}

References

Affected packages

Git / github.com/shopware/platform

Affected ranges

Type: GIT
Repo: https://github.com/shopware/platform
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

cabe8ec825a787f72c2222dbe529fa7e1fd6ebfb

Affected versions

v6.*

v6.0.0+dp1

v6.0.0+ea1

v6.0.0+ea1.1

v6.0.0+ea2

v6.1.0

v6.1.0-rc1

v6.1.0-rc2

v6.1.0-rc3

v6.1.0-rc4

v6.1.1

v6.1.2

v6.1.3

v6.1.4

v6.1.5

v6.2.0

v6.2.0-RC1

v6.2.1

v6.2.2

v6.2.3

v6.3.0.0

v6.3.0.1

v6.3.0.2

v6.3.3.0

v6.3.3.1

v6.3.4.1

v6.3.5.0

v6.4.1.0

v6.4.1.1

v6.4.1.2

v6.4.10.0

v6.4.3.0

v6.4.3.1

v6.4.4.0

v6.4.4.1

v6.4.5.0

v6.4.5.1

v6.4.6.0

v6.4.6.1

v6.4.8.0

v6.4.8.1

v6.4.8.2

v6.4.9.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-24872.json"

Git / github.com/shopware/shopware