p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in shopware/storefront

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für shopware/storefront: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 5

  1. CVE-2025-67648

    Hoch · CVSS 7.1EPSS 0,19%Korrektur verfügbar

    Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Page

    Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter, waitTime, which lacks proper input validation. This issue is fixed in versions 6.6.10.10 and 6.7.5.1.

    shopware/storefront shopware/storefrontPHP
    • Auf 6.6.10.10 aktualisieren
    • Auf 6.7.5.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2024-27917

    Hoch · CVSS 7.5EPSS 0,61%Korrektur verfügbar

    Shopware's session is persistent in Cache for 404 pages

    Shopware is an open commerce platform based on Symfony Framework and Vue. The Symfony Session Handler pops the Session Cookie and assigns it to the Response. Since Shopware 6.5.8.0, the 404 pages are cached to improve the performance of 404 pages. So the cached Response which contains a Session Cookie when the Browser accessing the 404 page, has no cookies yet. The Symfony Session Handler is in use, when no explicit Session configuration has been done. When Redis is in use for Sessions using the PHP Redis extension, this exploiting code is not used. Shopware version 6.5.8.7 contains a patch for this issue. As a workaround, use Redis for Sessi

    shopware/storefrontPHP
    • Auf 6.5.8.7 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2022-24745

    Mittel · CVSS 4.8EPSS 0,53%Korrektur verfügbar

    Guest session is shared between customers in shopware

    Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessions are shared between customers when HTTP cache is enabled. This can lead to inconsistent experiences for guest users. Setups with Varnish are not affected by this issue. This issue has been resolved in version 6.4.8.2. Users unable to upgrade should disable the HTTP Cache.

    shopware/storefrontPHP
    • Auf 6.4.8.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  4. CVE-2022-24746

    Mittel · CVSS 6.1EPSS 0,84%Korrektur verfügbar

    HTML injection possibility in voucher code form

    Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions it is possible to inject code via the voucher code form. This issue has been patched in version 6.4.8.1. There are no known workarounds for this issue.

    shopware/storefrontPHP
    • Auf 6.4.8.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2022-24747

    Mittel · CVSS 6.3EPSS 1,1%Korrektur verfügbar

    HTTP caching is marking private HTTP headers as public

    Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do no properly set sensitive HTTP headers to be non-cacheable. If there is an HTTP cache between the server and client then headers may be exposed via HTTP caches. This issue has been resolved in version 6.4.8.2. There are no known workarounds.

    shopware/storefrontPHP
    • Auf 6.4.8.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →