CVE-2023-34099 - OpenCVE

Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. This issue has been addressed in version 5.7.18 and users are advised to update. There are no known workarounds for this vulnerability.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Shopware	Shopware

Configuration 1 [-]

cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023
https://github.com/shopware/shopware/security/advisories/GHSA-gh66-fp7j-98v5
https://github.com/shopware5/shopware/commit/39cc714d9a0be33b43877044d0b88ea3c6b43f3d
https://www.shopware.com/en/changelog-sw5/#5-7-18

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-06-27T16:29:07.220Z

Updated: 2024-08-02T16:01:53.452Z

Reserved: 2023-05-25T21:56:51.245Z

Link: CVE-2023-34099

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2023-06-27T17:15:09.813

Modified: 2023-07-06T15:58:20.110

Link: CVE-2023-34099

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-34099", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-05-25T21:56:51.245Z", "datePublished": "2023-06-27T16:29:07.220Z", "dateUpdated": "2024-08-02T16:01:53.452Z"}, "containers": {"cna": {"title": "Improper mail validation in Shopware", "problemTypes": [{"descriptions": [{"cweId": "CWE-754", "lang": "en", "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/shopware/shopware/security/advisories/GHSA-gh66-fp7j-98v5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/shopware/shopware/security/advisories/GHSA-gh66-fp7j-98v5"}, {"name": "https://github.com/shopware5/shopware/commit/39cc714d9a0be33b43877044d0b88ea3c6b43f3d", "tags": ["x_refsource_MISC"], "url": "https://github.com/shopware5/shopware/commit/39cc714d9a0be33b43877044d0b88ea3c6b43f3d"}, {"name": "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023", "tags": ["x_refsource_MISC"], "url": "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023"}, {"name": "https://www.shopware.com/en/changelog-sw5/#5-7-18", "tags": ["x_refsource_MISC"], "url": "https://www.shopware.com/en/changelog-sw5/#5-7-18"}], "affected": [{"vendor": "shopware", "product": "shopware", "versions": [{"version": "< 5.7.18", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-06-27T16:29:07.220Z"}, "descriptions": [{"lang": "en", "value": "Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. This issue has been addressed in version 5.7.18 and users are advised to update. There are no known workarounds for this vulnerability."}], "source": {"advisory": "GHSA-gh66-fp7j-98v5", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T16:01:53.452Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/shopware/shopware/security/advisories/GHSA-gh66-fp7j-98v5", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/shopware/shopware/security/advisories/GHSA-gh66-fp7j-98v5"}, {"name": "https://github.com/shopware5/shopware/commit/39cc714d9a0be33b43877044d0b88ea3c6b43f3d", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/shopware5/shopware/commit/39cc714d9a0be33b43877044d0b88ea3c6b43f3d"}, {"name": "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023"}, {"name": "https://www.shopware.com/en/changelog-sw5/#5-7-18", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.shopware.com/en/changelog-sw5/#5-7-18"}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*", "matchCriteriaId": "23A10682-F8C8-4201-96A4-ACFEF0B01247", "versionEndIncluding": "5.7.17", "versionStartIncluding": "5.1.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. This issue has been addressed in version 5.7.18 and users are advised to update. There are no known workarounds for this vulnerability."}], "id": "CVE-2023-34099", "lastModified": "2023-07-06T15:58:20.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2023-06-27T17:15:09.813", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/shopware/shopware/security/advisories/GHSA-gh66-fp7j-98v5"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/shopware5/shopware/commit/39cc714d9a0be33b43877044d0b88ea3c6b43f3d"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://www.shopware.com/en/changelog-sw5/#5-7-18"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-754"}], "source": "security-advisories@github.com", "type": "Primary"}]}