Shopware is an open headless commerce platform. In the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions that modify the payment, delivery, and/or order status. Due to this inadequate implementation, users lacking 'write' permissions for orders are still able to change the order state. This issue has been addressed and users are advised to update to Shopware 6.5.7.4. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2024-01-16T22:29:06.955Z
Updated: 2024-08-01T22:43:34.954Z
Reserved: 2024-01-10T15:09:55.549Z
Link: CVE-2024-22407
Vulnrichment
No data.
NVD
Status : Analyzed
Published: 2024-01-16T23:15:08.453
Modified: 2024-01-24T17:03:42.037
Link: CVE-2024-22407
Redhat
No data.