Shopware Remote Code Execution Vulnerability
Summary
GHSA-q3g4-2vw9-xv27: Shopware Remote Code Execution Vulnerability. Affects shopware/shopware across 2 version ranges.
< 1.0.8
>= 4.0.0, < 5.2.15
Fixed in 1.0.8 or 5.2.15, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Shopware is an open-source e-commerce platform that allows users to create and manage online stores. It provides a wide range of features for product management, customer management, order processing, and more. However, a critical security vulnerability has been discovered in Shopware that could allow unauthorized remote code execution. This vulnerability affects all versions of Shopware, including Shopware 5.2.14.
Vulnerability Detail
Under certain circumstances, it's possible to execute unauthorized foreign code in Shopware, leading to a remote code execution vulnerability. This vulnerability poses a significant risk to the entire system, as an attacker could potentially gain full control over the affected Shopware installation. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.0.81.0.8composer require shopware/shopware:1.0.8 -
>= 4.0.0, < 5.2.155.2.15composer require shopware/shopware:5.2.15
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version as soon as possible to protect the Shopware installation from potential exploitation.
Conclusion
The Shopware Remote Code Execution Vulnerability is a critical security issue that affects all versions of Shopware, including Shopware 5.2.14. It allows for unauthorized remote code execution, potentially leading to a complete compromise of the affected Shopware installation. To mitigate this vulnerability, it is crucial to update Shopware to version 5.2.15 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for shopware/shopware →
FAQ
Shopware is an open-source e-commerce platform used for creating and managing online stores.
This vulnerability allows for unauthorized remote code execution, which could lead to a complete compromise of the affected Shopware installation.
All versions of Shopware, including Shopware 5.2.14, are affected by this vulnerability.
To fix this vulnerability, update Shopware to version 5.2.15 or later.
No, there is no known workaround for this vulnerability. Updating to the fixed version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for shopware/shopware.
