CVE-2022-31057 - OpenCVE

Shopware is an open source e-commerce software made in Germany. Versions of Shopware 5 prior to version 5.7.12 are subject to an authenticated Stored XSS in Administration. Users are advised to upgrade. There are no known workarounds for this issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:S/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Shopware	Shopware

Configuration 1 [-]

cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2022
https://github.com/shopware/shopware/commit/3e025a0a3e123f4108082645b1ced6fb548f7b6f
https://github.com/shopware/shopware/security/advisories/GHSA-q754-vwc4-p6qj
https://packagist.org/packages/shopware/shopware

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2022-06-27T19:30:26

Updated: 2024-08-03T07:03:40.213Z

Reserved: 2022-05-18T00:00:00

Link: CVE-2022-31057

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-06-27T20:15:08.527

Modified: 2022-07-07T18:12:44.420

Link: CVE-2022-31057

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "shopware", "vendor": "shopware", "versions": [{"status": "affected", "version": "< 5.7.12"}]}], "descriptions": [{"lang": "en", "value": "Shopware is an open source e-commerce software made in Germany. Versions of Shopware 5 prior to version 5.7.12 are subject to an authenticated Stored XSS in Administration. Users are advised to upgrade. There are no known workarounds for this issue."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-06-27T19:30:26", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/shopware/shopware/security/advisories/GHSA-q754-vwc4-p6qj"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/shopware/shopware/commit/3e025a0a3e123f4108082645b1ced6fb548f7b6f"}, {"tags": ["x_refsource_MISC"], "url": "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2022"}, {"tags": ["x_refsource_MISC"], "url": "https://packagist.org/packages/shopware/shopware"}], "source": {"advisory": "GHSA-q754-vwc4-p6qj", "discovery": "UNKNOWN"}, "title": "Authenticated Stored XSS in Shopware Administration", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-31057", "STATE": "PUBLIC", "TITLE": "Authenticated Stored XSS in Shopware Administration"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "shopware", "version": {"version_data": [{"version_value": "< 5.7.12"}]}}]}, "vendor_name": "shopware"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Shopware is an open source e-commerce software made in Germany. Versions of Shopware 5 prior to version 5.7.12 are subject to an authenticated Stored XSS in Administration. Users are advised to upgrade. There are no known workarounds for this issue."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}]}, "references": {"reference_data": [{"name": "https://github.com/shopware/shopware/security/advisories/GHSA-q754-vwc4-p6qj", "refsource": "CONFIRM", "url": "https://github.com/shopware/shopware/security/advisories/GHSA-q754-vwc4-p6qj"}, {"name": "https://github.com/shopware/shopware/commit/3e025a0a3e123f4108082645b1ced6fb548f7b6f", "refsource": "MISC", "url": "https://github.com/shopware/shopware/commit/3e025a0a3e123f4108082645b1ced6fb548f7b6f"}, {"name": "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2022", "refsource": "MISC", "url": "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2022"}, {"name": "https://packagist.org/packages/shopware/shopware", "refsource": "MISC", "url": "https://packagist.org/packages/shopware/shopware"}]}, "source": {"advisory": "GHSA-q754-vwc4-p6qj", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T07:03:40.213Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/shopware/shopware/security/advisories/GHSA-q754-vwc4-p6qj"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/shopware/shopware/commit/3e025a0a3e123f4108082645b1ced6fb548f7b6f"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2022"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://packagist.org/packages/shopware/shopware"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-31057", "datePublished": "2022-06-27T19:30:26", "dateReserved": "2022-05-18T00:00:00", "dateUpdated": "2024-08-03T07:03:40.213Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*", "matchCriteriaId": "7E56713A-1AC1-4523-92A6-A7CFD85CDEEE", "versionEndExcluding": "5.7.12", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Shopware is an open source e-commerce software made in Germany. Versions of Shopware 5 prior to version 5.7.12 are subject to an authenticated Stored XSS in Administration. Users are advised to upgrade. There are no known workarounds for this issue."}, {"lang": "es", "value": "Shopware es un software de comercio electr\u00f3nico de c\u00f3digo abierto fabricado en Alemania. Las versiones de Shopware 5 anteriores a versi\u00f3n 5.7.12 est\u00e1n sujetas a un ataque de tipo XSS almacenado autenticado en la administraci\u00f3n. Es recomendado a usuarios actualizar. No se presentan mitigaciones conocidas para este problema"}], "id": "CVE-2022-31057", "lastModified": "2022-07-07T18:12:44.420", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 3.7, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2022-06-27T20:15:08.527", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2022"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/shopware/shopware/commit/3e025a0a3e123f4108082645b1ced6fb548f7b6f"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/shopware/shopware/security/advisories/GHSA-q754-vwc4-p6qj"}, {"source": "security-advisories@github.com", "tags": ["Product", "Third Party Advisory"], "url": "https://packagist.org/packages/shopware/shopware"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Primary"}]}