CVE-2023-22733: Shopware's log module vulnerable to Improper Output Neutralization
Impact
The log module contains all kind of sent mails. It is possible to see the password reset email of customers and admin users to gain probably more access.
Patches Update to the latest 6.4.18.1 version.
Workarounds - For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. - Remove from all users the log module ACL rights - Disable logging
References https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates
Other sources
Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions the log module would write out all kind of sent mails. An attacker with access to either the local system logs or a centralized logging store may have access to other users accounts. This issue has been addressed in version 6.4.18.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. Users unable to upgrade may remove from all users the log module ACL rights or disable logging.
Shopware's log module vulnerable to Improper Output Neutralization
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/shopware/coreto a version that resolves this vulnerability.Fixed in 6.4.18.1 - Upgrade
Upgrade
composer/shopware/platformto a version that resolves this vulnerability.Fixed in 6.4.18.1 - Upgrade
Upgrade
Shopwareto a version that resolves this vulnerability.Fixed in 6.4.18.1 - Configuration
Remove the log module ACL rights from all users.
Shopware log module log module ACL rights = removed from all users - Configuration
Disable logging if upgrading is not possible.
Shopware log module logging = disabled
Event History
Frequently Asked Questions
What is CVE-2023-22733?
CVE-2023-22733 is a vulnerability in Shopware, an open source commerce platform, that allows an attacker with access to either the local system logs or a centralized logging store to potentially have access to other users' accounts.
What is the severity of CVE-2023-22733?
CVE-2023-22733 has a severity value of 6.5, which is considered medium.
How does CVE-2023-22733 affect Shopware?
CVE-2023-22733 affects Shopware versions up to and including 6.4.18.1.
How can an attacker exploit CVE-2023-22733?
An attacker with access to the system logs can potentially exploit CVE-2023-22733 by gaining unauthorized access to other users' accounts.
Is there a fix available for CVE-2023-22733?
Yes, a fix for CVE-2023-22733 is available. It is recommended to update to a patched version of Shopware to mitigate the vulnerability.