-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in the Shopware import/export functionality, which failed to properly authorize access to sensitive entity fields. The core of the issue is within the Shopware\Core\Content\ImportExport\ImportExport class, specifically in the export and import methods. Before the patch, these methods would process a user-defined import/export profile and its field mappings without checking if the user or the context (e.g., API) was permitted to access those fields. This allowed a malicious user with administrative privileges to create a profile that mapped to sensitive database columns, such as password in the customer entity. When an export was triggered using this profile, the export function would read and expose sensitive data like password hashes. The fix, introduced in commit c2c98050aff7b90fe7232f6dac9b6b7143183083, adds a new method, filterApiAwareFields. This method is now called at the beginning of both the import and export functions to filter the mappings in the provided configuration. It inspects each field in the mapping and checks for an ApiAware flag, ensuring that only fields explicitly designated as safe for API operations are included in the import/export process. This effectively blocklists sensitive fields and mitigates the information disclosure vulnerability.
Shopware\Core\Content\ImportExport\ImportExport::exportsrc/Core/Content/ImportExport/ImportExport.php
Shopware\Core\Content\ImportExport\ImportExport::importsrc/Core/Content/ImportExport/ImportExport.php
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| shopware/platform | composer | >= 6.7.0.0, < 6.7.3.1 | 6.7.3.1 |
| shopware/platform | composer | < 6.6.10.7 | 6.6.10.7 |
| shopware/core | composer | >= 6.7.0.0, < 6.7.3.1 | 6.7.3.1 |
| shopware/core | composer | < 6.6.10.7 | 6.6.10.7 |
Ongoing coverage of React2Shell