CVE-2023-34099
First published: Tue Jun 27 2023(Updated: )
Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. This issue has been addressed in version 5.7.18 and users are advised to update. There are no known workarounds for this vulnerability.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Shopware Shopware | >=5.1.4<=5.7.17 | |
| composer/shopware/shopware | >=5.1.4<=5.7.17 | 5.7.18 |
| >=5.1.4<=5.7.17 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023
- https://github.com/shopware/shopware/security/advisories/GHSA-gh66-fp7j-98v5
- https://github.com/shopware5/shopware/commit/39cc714d9a0be33b43877044d0b88ea3c6b43f3d
- https://www.shopware.com/en/changelog-sw5/#5-7-18
- https://github.com/shopware5/shopware/security/advisories/GHSA-gh66-fp7j-98v5
- https://nvd.nist.gov/vuln/detail/CVE-2023-34099
- https://github.com/advisories/GHSA-gh66-fp7j-98v5 (Advisory)
Frequently Asked Questions
What is CVE-2023-34099?
CVE-2023-34099 is a vulnerability in Shopware's mail validation process that allows the construction of different email addresses resulting in multiple accounts sharing the same address.
How does CVE-2023-34099 impact Shopware?
CVE-2023-34099 allows attackers to exploit the flawed mail validation process in Shopware's registration process, leading to multiple accounts sharing the same email address.
What is the severity of CVE-2023-34099?
CVE-2023-34099 has a severity rating of 5.3 (medium).
How can I fix CVE-2023-34099?
To fix CVE-2023-34099, update Shopware to version 5.7.18 or later, as this issue has been addressed in that version.
Where can I find more information about CVE-2023-34099?
You can find more information about CVE-2023-34099 in the reference links provided: [Shopware Security Updates](https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023), [Shopware GitHub Advisory](https://github.com/shopware/shopware/security/advisories/GHSA-gh66-fp7j-98v5), [Shopware GitHub Commit](https://github.com/shopware5/shopware/commit/39cc714d9a0be33b43877044d0b88ea3c6b43f3d).
- collector/nvd-index
- collector/github-advisory-latest
- alias/GHSA-gh66-fp7j-98v5
- alias/CVE-2023-34099
- collector/nvd-cve
- collector/github-advisory
- vendor/shopware
- canonical/shopware shopware
- version/shopware shopware/5.1.4
- version/shopware shopware/5.7.17
- package-manager/composer