CVE-2024-22407 json
Broken Access Control order API in Shopware
published 2024-01-16 2 y ago modified 2026-09-10 1 mo ago also GHSA-3867-jc5c-66qf , EUVD-2024-0229
- cvss
- 4.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 34%
- public exploits
- 0
- none known
Summary
Shopware is an open headless commerce platform. In the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions that modify the payment, delivery, and/or order status. Due to this inadequate implementation, users lacking 'write' permissions for orders are still able to change the order state. This issue has been addressed and users are advised to update to Shopware 6.5.7.4. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Patch / fix
- packagist shopware/core 6.5.7.4
- packagist shopware/platform 6.5.7.4
- shopware shopware 6.5.7.4
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | shopware/core | <6.5.7.4 |
6.5.7.4 |
| packagist | shopware/platform | <6.5.7.4 |
6.5.7.4 |
Affected products
- shopware shopware
Classification
- Weakness
-
- CWE-284 Improper Access Control
References
-
github.com
/shopware/core/commit/78142489264f9262eaaa436ba036df40026a06be
web
-
github.com
/shopware/shopware/commit/fb25e24ca51650009ffa2520f1e67b48b911354a
web
-
github.com
/shopware/shopware/security/advisories/GHSA-3867-jc5c-66qf
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-22407
advisory
-
github.com
/shopware/shopware
package
Sources
- CVE List CVE-2024-22407
- GitHub Advisory GHSA-3867-jc5c-66qf
- NVD CVE-2024-22407
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.