CVE-2024-42354

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-42354", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-07-30T14:01:33.922Z", "datePublished": "2024-08-08T14:44:24.678Z", "dateUpdated": "2024-08-08T15:24:38.347Z"}, "containers": {"cna": {"title": "Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/shopware/shopware/security/advisories/GHSA-hhcq-ph6w-494g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/shopware/shopware/security/advisories/GHSA-hhcq-ph6w-494g"}, {"name": "https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f", "tags": ["x_refsource_MISC"], "url": "https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f"}, {"name": "https://github.com/shopware/core/commit/d35ee2eda5c995faeb08b3dad127eab65c64e2a2", "tags": ["x_refsource_MISC"], "url": "https://github.com/shopware/core/commit/d35ee2eda5c995faeb08b3dad127eab65c64e2a2"}, {"name": "https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac", "tags": ["x_refsource_MISC"], "url": "https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac"}, {"name": "https://github.com/shopware/shopware/commit/ad83d38809df457efef21c37ce0996430334bf01", "tags": ["x_refsource_MISC"], "url": "https://github.com/shopware/shopware/commit/ad83d38809df457efef21c37ce0996430334bf01"}], "affected": [{"vendor": "shopware", "product": "shopware", "versions": [{"version": "<= 6.5.8.12", "status": "affected"}, {"version": ">= 6.6.0.0, <= 6.6.5.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-08-08T14:44:24.678Z"}, "descriptions": [{"lang": "en", "value": "Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON. Prior to versions 6.6.5.1 and 6.5.8.13, the processing of the Criteria did not considered ManyToMany associations and so they were not considered properly and the protections didn't get used. This issue cannot be reproduced with the default entities by Shopware, but can be triggered with extensions. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin."}], "source": {"advisory": "GHSA-hhcq-ph6w-494g", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-08T15:24:16.776137Z", "id": "CVE-2024-42354", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-08T15:24:38.347Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42354", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-08T15:24:16.776137Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-08T15:24:34.884Z"}}], "cna": {"title": "Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api", "source": {"advisory": "GHSA-hhcq-ph6w-494g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "shopware", "product": "shopware", "versions": [{"status": "affected", "version": "<= 6.5.8.12"}, {"status": "affected", "version": ">= 6.6.0.0, <= 6.6.5.0"}]}], "references": [{"url": "https://github.com/shopware/shopware/security/advisories/GHSA-hhcq-ph6w-494g", "name": "https://github.com/shopware/shopware/security/advisories/GHSA-hhcq-ph6w-494g", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f", "name": "https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/shopware/core/commit/d35ee2eda5c995faeb08b3dad127eab65c64e2a2", "name": "https://github.com/shopware/core/commit/d35ee2eda5c995faeb08b3dad127eab65c64e2a2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac", "name": "https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/shopware/shopware/commit/ad83d38809df457efef21c37ce0996430334bf01", "name": "https://github.com/shopware/shopware/commit/ad83d38809df457efef21c37ce0996430334bf01", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON. Prior to versions 6.6.5.1 and 6.5.8.13, the processing of the Criteria did not considered ManyToMany associations and so they were not considered properly and the protections didn't get used. This issue cannot be reproduced with the default entities by Shopware, but can be triggered with extensions. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-08-08T14:44:24.678Z"}}}, "cveMetadata": {"cveId": "CVE-2024-42354", "state": "PUBLISHED", "dateUpdated": "2024-08-08T15:24:38.347Z", "dateReserved": "2024-07-30T14:01:33.922Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-08-08T14:44:24.678Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "shopware", "vendor": "shopware", "versions": [{"status": "affected", "version": "<= 6.5.8.12"}, {"status": "affected", "version": ">= 6.6.0.0, <= 6.6.5.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*", "matchCriteriaId": "753BEB88-95EE-4F3B-8398-4958604B3675", "versionEndExcluding": "6.5.8.13", "vulnerable": true}, {"criteria": "cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F1229086-0807-43FD-9ADF-478B2C8C0974", "versionEndExcluding": "6.6.5.1", "versionStartIncluding": "6.6.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON. Prior to versions 6.6.5.1 and 6.5.8.13, the processing of the Criteria did not considered ManyToMany associations and so they were not considered properly and the protections didn't get used. This issue cannot be reproduced with the default entities by Shopware, but can be triggered with extensions. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin."}, {"lang": "es", "value": "Shopware es una plataforma de comercio abierta. La API de la tienda funciona con entidades normales y no expone todos los campos para la API p\u00fablica; Los campos deben marcarse como ApiAware en EntityDefinition. Por lo tanto, solo los campos ApiAware de EntityDefinition se codificar\u00e1n en el JSON final. Antes de las versiones 6.6.5.1 y 6.5.8.13, el procesamiento de los Criterios no consideraba las asociaciones ManyToMany por lo que no se consideraban adecuadamente y no se utilizaban las protecciones. Shopware no puede reproducir este problema con las entidades predeterminadas, pero puede activarse con extensiones. Actualice a Shopware 6.6.5.1 o 6.5.8.13 para recibir un parche. Para las versiones anteriores 6.2, 6.3 y 6.4 tambi\u00e9n est\u00e1n disponibles las medidas de seguridad correspondientes a trav\u00e9s de un complemento."}], "id": "CVE-2024-42354", "lastModified": "2026-06-17T07:49:18.903", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-42354", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-08-08T15:24:16.776137Z", "version": "2.0.3"}}]}, "published": "2024-08-08T15:15:17.793", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/shopware/core/commit/d35ee2eda5c995faeb08b3dad127eab65c64e2a2"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/shopware/shopware/commit/ad83d38809df457efef21c37ce0996430334bf01"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/shopware/shopware/security/advisories/GHSA-hhcq-ph6w-494g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}