CVE-2022-24872

    Dashboard / Vulnerabilities / CVE-2022-24872

    CVE-2022-24872

    Published: 20 Apr 2022Last Modified: 12 Aug 2026

    Summary: Improper Access Control in shopware

    Details: Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by admin-api are still usable within normal user session. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue.

    References: https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24872.json, https://github.com/shopware/platform/security/advisories/GHSA-9wrv-g75h-8ccc, https://nvd.nist.gov/vuln/detail/CVE-2022-24872, https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77c

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -cabe8ec825a787f72c2222dbe529fa7e1fd6ebfb

    Affected versions

    v6.4.10.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High