CVE-2024-42355
criticalpriority · track · 39EPSS 0.009 · 58 %ileEUUSEPSS · scored 2026-10-23
Shopware, an open ecommerce platform, has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag. Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and allows execution of code. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.3–9.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (8)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-27wp-jvhw-v4xpShopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag2024-08-08ghsa · osvUS
### Impact Shopware has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag. It accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and allows execution of code. ### Patches Update to Shopware 6.6.5.1 or 6.5.8.13 ### Workarounds For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (16)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2024-42355/cnnvd
- https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442fcnnvd
- https://github.com/shopware/core/commit/d35ee2eda5c995faeb08b3dad127eab65c64e2a2cnnvd
- https://github.com/shopware/shopware/commit/445c6763cc093fbd651e0efaa4150deae4ae60dacnnvd
- https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0accnnvd
- https://github.com/shopware/shopware/security/advisories/GHSA-27wp-jvhw-v4xpcnnvd
- https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442fenisa_euvd
- https://github.com/shopware/core/commit/d35ee2eda5c995faeb08b3dad127eab65c64e2a2enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan