CVE-2017-15374: XSS
Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to provoke persistent execution in the customer and orders section of the backend. The execution occurs in the administrator backend listing when processing a preview of the customers (kunden) or orders (bestellungen). The injection can be performed interactively via user registration or by manipulation of the order information inputs. The issue can be exploited by low privileged user accounts against higher privileged (admin or moderator) accounts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-15374?
CVE-2017-15374 is considered a medium severity vulnerability due to its potential for exploiting cross-site scripting.
How do I fix CVE-2017-15374?
To fix CVE-2017-15374, upgrade Shopware to versions 5.3.1 or later where the vulnerability has been patched.
What versions of Shopware are affected by CVE-2017-15374?
CVE-2017-15374 affects Shopware versions 5.2.5 to 5.3.0.
What kind of attack does CVE-2017-15374 enable?
CVE-2017-15374 enables remote attackers to inject malicious script code via vulnerable input fields in the backend of the content management system.
Is user data at risk due to CVE-2017-15374?
Yes, user data may be at risk as CVE-2017-15374 allows attackers to execute scripts that could lead to data theft or unauthorized actions.