CVE-2023-22733
mediumpriority · track · 26EPSS 0.007 · 53 %ileEUUSEPSS · scored 2026-10-27
Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions the log module would write out all kind of sent mails. An attacker with access to either the local system logs or a centralized logging store may have access to other users accounts. This issue has been addressed in version 6.4.18.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. Users unable to upgrade may remove from all users the log module ACL rights or disable logging.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 2.7–6.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-7cp7-jfp6-jh4fShopware's log module vulnerable to Improper Output Neutralization2023-01-20ghsa · osvUS
### Impact The log module contains all kind of sent mails. It is possible to see the password reset email of customers and admin users to gain probably more access. ### Patches Update to the latest 6.4.18.1 version. ### Workarounds - For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. - Remove from all users the log module ACL rights - [Disable logging](https://developer.shopware.com/docs/guides/hosting/performance/performance-tweaks#logging) ### References https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (13)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-22733/cnnvd
- https://developer.shopware.com/docs/guides/hosting/performance/performance-tweaks#loggingcnnvd
- https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updatescnnvd
- https://github.com/shopware/platform/commit/407a83063d7141c1a626441799c3ebef79498c07cnnvd
- https://github.com/shopware/platform/security/advisories/GHSA-7cp7-jfp6-jh4fcnnvd
- https://developer.shopware.com/docs/guides/hosting/performance/performance-tweaks#loggingenisa_euvd
- https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updatesenisa_euvd
- https://github.com/shopware/platform/commit/407a83063d7141c1a626441799c3ebef79498c07enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan