CVE-2022-21651

Published: Jan 5, 2022Modified: Nov 21, 2024

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Shopware is an open source e-commerce software platform. An open redirect vulnerability has been discovered. Users may be arbitrary redirected due to incomplete URL handling in the shopware router. This issue has been resolved in version 5.7.7. There is no workaround and users are advised to upgrade as soon as possible.

Affected (1)

Products: Shopware: Shopware

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Shopware Shopware	From 5.0.0 to 5.7.7

Related CWEs

URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

References (6)

https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022

Source: security-advisories@github.com

PatchVendor Advisory

https://github.com/shopware/shopware/commit/a90046c765c57a46c4399dce17bd174253c32886

Source: security-advisories@github.com

PatchThird Party Advisory

https://github.com/shopware/shopware/security/advisories/GHSA-c53v-qmrx-93hg

Source: security-advisories@github.com

PatchThird Party Advisory

https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://github.com/shopware/shopware/commit/a90046c765c57a46c4399dce17bd174253c32886

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/shopware/shopware/security/advisories/GHSA-c53v-qmrx-93hg

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.