CVE-2023-34099: Improper mail validation in Shopware
Impact The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts.
Patches We recommend updating to the current version 5.7.18. You can get the update to 5.7.18 regularly via the Auto-Updater or directly via the release page. https://github.com/shopware5/shopware/releases/tag/v5.7.18
For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html
References https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023
Other sources
Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. This issue has been addressed in version 5.7.18 and users are advised to update. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/shopware/shopwareto a version that resolves this vulnerability.Fixed in 5.7.18 - Upgrade
Upgrade
Shopwareto a version that resolves this vulnerability.Fixed in 5.7.18 - Compensating control
If you cannot update Shopware, use the Security Plugin to address older versions (as referenced: “For older versions you can use the Security Plugin: Improper mail validation in Shopware”).
Event History
Frequently Asked Questions
What is CVE-2023-34099?
CVE-2023-34099 is a vulnerability in Shopware's mail validation process that allows the construction of different email addresses resulting in multiple accounts sharing the same address.
How does CVE-2023-34099 impact Shopware?
CVE-2023-34099 allows attackers to exploit the flawed mail validation process in Shopware's registration process, leading to multiple accounts sharing the same email address.
What is the severity of CVE-2023-34099?
CVE-2023-34099 has a severity rating of 5.3 (medium).
How can I fix CVE-2023-34099?
To fix CVE-2023-34099, update Shopware to version 5.7.18 or later, as this issue has been addressed in that version.
Where can I find more information about CVE-2023-34099?
You can find more information about CVE-2023-34099 in the reference links provided: [Shopware Security Updates](https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023), [Shopware GitHub Advisory](https://github.com/shopware/shopware/security/advisories/GHSA-gh66-fp7j-98v5), [Shopware GitHub Commit](https://github.com/shopware5/shopware/commit/39cc714d9a0be33b43877044d0b88ea3c6b43f3d).