Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Page
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.10.10, 6.7.5.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter, waitTime, which lacks proper input validation. This issue is fixed in versions 6.6.10.10 and 6.7.5.1.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- shopware shopware
From 6.4.6.0 · fixed in 6.6.10.10; From 6.7.0.0 · fixed in 6.7.5.1
- shopware/shopwarePackagist
From 6.4.6.0 · fixed in 6.6.10.10
- shopware/storefrontPackagist
From 6.4.6.0 · fixed in 6.6.10.10
- shopware/shopwarePackagist
From 6.7.0.0 · fixed in 6.7.5.1
- shopware/storefrontPackagist
From 6.7.0.0 · fixed in 6.7.5.1