CVE-2023-22734

 

Published at: - 17-01-2023 11:15

Last modified: - 25-01-2023 06:26

Total changes: - 2

Description

Shopware is an open source commerce platform based on Symfony Framework and Vue js. The newsletter double opt-in validation was not checked properly, and it was possible to skip the complete double opt in process. As a result operators may have inconsistencies in their newsletter systems. This problem has been fixed with version 6.4.18.1. Users are advised to upgrade. Users unable to upgrade may find security measures are available via a plugin for major versions 6.1, 6.2, and 6.3. Users may also disable newsletter registration completely.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

 

Verification logic

 

Reference

• https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates
• https://github.com/shopware/platform/security/advisories/GHSA-46h7-vj7x-fxg2
• https://github.com/shopware/platform/commit/f5a95ee2bcf1e546878450963ef1d9886e59a620

 

Keywords

NVD

 

CVE-2023-22734

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures