Skip to main content

Improper Access Control

CVE-2024-42354

Medium
5.9/10

Summary

Shopware is an open-commerce platform. The store-API works with regular entities and does not expose all fields to the public API fields that need to be marked as ApiAware in the "EntityDefinition". So, only ApiAware fields of the "EntityDefinition" will be encoded into the final JSON. The processing of the Criteria did not consider "ManyToMany" associations, and so they were not considered properly, and the protection didn't get used. This issue cannot be reproduced with the default entities by Shopware, but can be triggered with extensions. This issue affects the package's shopware/core and shopware/platform versions prior to 6.5.8.13 and 6.6.x prior to 6.6.5.1. For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin.

  • HIGH
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-284 - Improper Access Control

Listed 5th in the 'OWASP Top Ten', improper (or broken) access control attacks are a fundamental type of vulnerability. This includes a broad range of design flaws that enable users to act outside of their intended permissions. They can use these privileges to gain access to restricted files and functionality such as accessing restricted information, falsifying records, destroying data, or executing commands.

References

Advisory Timeline

  • Published