CVE-2023-22733
First published: Tue Jan 17 2023(Updated: )
Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions the log module would write out all kind of sent mails. An attacker with access to either the local system logs or a centralized logging store may have access to other users accounts. This issue has been addressed in version 6.4.18.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. Users unable to upgrade may remove from all users the log module ACL rights or disable logging.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Shopware Shopware | <6.4.18.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://developer.shopware.com/docs/guides/hosting/performance/performance-tweaks#logging
- https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates
- https://github.com/shopware/platform/commit/407a83063d7141c1a626441799c3ebef79498c07
- https://github.com/shopware/platform/security/advisories/GHSA-7cp7-jfp6-jh4f
Frequently Asked Questions
What is CVE-2023-22733?
CVE-2023-22733 is a vulnerability in Shopware, an open source commerce platform, that allows an attacker with access to either the local system logs or a centralized logging store to potentially have access to other users' accounts.
What is the severity of CVE-2023-22733?
CVE-2023-22733 has a severity value of 6.5, which is considered medium.
How does CVE-2023-22733 affect Shopware?
CVE-2023-22733 affects Shopware versions up to and including 6.4.18.1.
How can an attacker exploit CVE-2023-22733?
An attacker with access to the system logs can potentially exploit CVE-2023-22733 by gaining unauthorized access to other users' accounts.
Is there a fix available for CVE-2023-22733?
Yes, a fix for CVE-2023-22733 is available. It is recommended to update to a patched version of Shopware to mitigate the vulnerability.
- collector/nvd-index
- agent/weakness
- agent/references
- agent/author
- agent/severity
- agent/tags
- agent/type
- agent/event
- agent/description
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- vendor/shopware
- canonical/shopware shopware