CVE-2023-34099 json
Improper mail validation in Shopware
published 2023-06-27 3 y ago modified 2026-06-17 4 mo ago also GHSA-gh66-fp7j-98v5 , EUVD-2023-1803
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 51%
- public exploits
- 0
- none known
Summary
Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. This issue has been addressed in version 5.7.18 and users are advised to update. There are no known workarounds for this vulnerability.
Patch / fix
- packagist shopware/shopware 5.7.18
- shopware shopware 5.7.18
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.65% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | shopware/shopware | >=5.1.4, <5.7.18 |
5.7.18 |
Affected products
- shopware shopware
Classification
- Weakness
-
- CWE-754 Improper Check for Unusual or Exceptional Conditions
References
-
github.com
/shopware5/shopware/commit/39cc714d9a0be33b43877044d0b88ea3c6b43f3d
web, patch
-
docs.shopware.com
/en/shopware-5-en/security-updates/security-update-06-2023
web, patch, vendor-advisory
-
github.com
/shopware/shopware/security/advisories/GHSA-gh66-fp7j-98v5
web, vendor-advisory
-
shopware.com
/en/changelog-sw5/#5-7-18
web, release-notes
-
github.com
/shopware5/shopware/security/advisories/GHSA-gh66-fp7j-98v5
web
-
nvd.nist.gov
/vuln/detail/CVE-2023-34099
advisory
-
github.com
/shopware5/shopware
package
Sources
- CVE List CVE-2023-34099
- GitHub Advisory GHSA-gh66-fp7j-98v5
- NVD CVE-2023-34099
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.