SB2023011794 - Multiple vulnerabilities in Shopware

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023011794

SB2023011794 - Multiple vulnerabilities in Shopware

Published: January 17, 2023 Updated: May 20, 2026

Security Bulletin ID SB2023011794
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 20% Medium 40% Low 40%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Input validation error (CVE-ID: CVE-2023-22730)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to bypass clearance sale restrictions in the cart.

The vulnerability exists due to improper input validation in cart line item validation when handling API requests that add line items to the cart. A remote user can submit the same line item multiple times to bypass clearance sale restrictions in the cart.


2) Code Injection (CVE-ID: CVE-2023-22731)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper control of generation of code in Twig rendered views when rendering Twig templates without the Sandbox extension. A remote attacker can refer to global PHP functions through Twig filters such as map, filter, or sort to execute arbitrary code.

Only Twig environments without the Sandbox extension are vulnerable.


3) Insufficient Session Expiration (CVE-ID: CVE-2023-22732)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to reuse a stolen session cookie for authorization.

The vulnerability exists due to insufficient session expiration in the administration session handling when processing inactive administration sessions. A remote attacker can use a stolen session cookie to reuse old session credentials for authorization.


4) Improper Output Neutralization for Logs (CVE-ID: CVE-2023-22733)

CWE-ID: CWE-117 - Improper Output Neutralization for Logs

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper output neutralization for logs in the log module when viewing logged sent mails. A remote user can access password reset emails to disclose sensitive information.

The issue can expose password reset emails for both customers and administrative users.


5) Input validation error (CVE-ID: CVE-2023-22734)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to bypass newsletter double opt-in validation.

The vulnerability exists due to improper input validation in the newsletter subscription option validation when processing newsletter subscription requests. A remote attacker can submit a specially crafted subscription request to bypass newsletter double opt-in validation.


Remediation

Install update from vendor's website.

References