Skip to main content

Improper Input Validation

CVE-2023-22734

High
7.5/10

Summary

Shopware is an open-source commerce platform based on Symfony Framework and Vue js. The newsletter double opt-in validation was not checked properly in versions prior to 6.4.18.1, and it was possible to skip the complete double opt-in process. As a result, operators may have inconsistencies in their newsletter systems. Users are advised to upgrade. Users unable to upgrade may find security measures are available via a plugin for major versions 6.1, 6.2, and 6.3. Users may also disable newsletter registration completely.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • NONE

CWE-20 - Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

Advisory Timeline

  • Published