Home > Vulnerability Database > CVE-2024-42357

Mend.io Vulnerability Database

CVE-2024-42357

Date: August 8, 2024

Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the "aggregations" object. The "name" field in this "aggregations" object is vulnerable SQL-injection and can be exploited using SQL parameters. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.1, 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin.

Language: PHP

Severity Score

6.5

Related Resources (8)

Url: https://github.com/shopware/shopware/security/advisories/GHSA-p6w9-r443-r752

Url: https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac

Url: https://github.com/shopware/core/commit/63c05615694790f5790a04ef889f42b764fa53c9

Url: https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f

Url: https://github.com/shopware/shopware/commit/57ea2f3c59483cf7c0f853e7a0d68c23ded1fe5b

Url: https://nvd.nist.gov/vuln/detail/CVE-2024-42357

Url: https://github.com/shopware/shopware

Url: https://www.mend.io/vulnerability-database/CVE-2024-42357

Severity Score

6.5

Weakness Type (CWE)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CWE-89

CVSS v3

Base Score:	6.5
Attack Vector (AV):
Attack Complexity (AC):
Privileges Required (PR):
User Interaction (UI):
Scope (S):
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL

Mend.io Vulnerability Database

We found results for “”

CVE-2024-42357

Date: August 8, 2024

Language: PHP

Severity Score

Related Resources (8)

Severity Score

Weakness Type (CWE)

CVSS v3

Do you need more information?