CVE-2022-24873
mediumpriority · track · 24EPSS 0.008 · 56 %ileEUUSEPSS · scored 2026-10-27
Shopware is an open source e-commerce software platform. Prior to version 5.7.9, Shopware is vulnerable to non-stored cross-site scripting in the storefront. This issue is fixed in version 5.7.9. Users of older versions may attempt to mitigate the vulnerability by using the Shopware security plugin.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-4g29-fccr-p59wReflected Cross-site Scripting in Shopware storefront2022-04-28ghsa · osvUS
### Impact Not-stored XSS in storefront. Request parameter were directly assigned to the template, so that malicious code could be send via an URL. ### Patches We recommend updating to the current version 5.7.9. You can get the update to 5.7.9 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/changelog-sw5/#5-7-9 For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html ### References https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2022-24873/cnnvd
- https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022cnnvd
- https://github.com/shopware/shopware/security/advisories/GHSA-4g29-fccr-p59wcnnvd
- https://www.shopware.com/en/changelog-sw5/#5-7-9cnnvd
- https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022enisa_euvd
- https://github.com/shopware/shopware/security/advisories/GHSA-4g29-fccr-p59wenisa_euvd
- https://www.shopware.com/en/changelog-sw5/#5-7-9enisa_euvd
- https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022Vendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan