CVE-2022-24748: Incorrect Authentication in shopware
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it is possible to modify customers and to create orders without App Permission. This issue is a result of improper api route checking. Users are advised to upgrade to version 6.4.8.2. There are no known workarounds.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-24748?
CVE-2022-24748 is a vulnerability in Shopware versions prior to 6.4.8.2 that allows unauthorized modification of customers and creation of orders without App Permission due to improper API route checking.
How severe is CVE-2022-24748?
CVE-2022-24748 has a severity score of 7.5 (High).
How can I fix CVE-2022-24748?
To fix CVE-2022-24748, users are advised to upgrade to Shopware version 6.4.8.2 or later.
What is CWE-863?
CWE-863 refers to the vulnerability category 'Incorrect Authorization' which is applicable to CVE-2022-24748.
What is CWE-287?
CWE-287 refers to the vulnerability category 'Improper Authentication' which may be related to the underlying cause of CVE-2022-24748.