CVE-2022-21651
MEDIUMCVSS 6.1/10EPSS 0.77%
Last modified
CVE-2022-21651 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Shopware is an open source e-commerce software platform. An open redirect vulnerability has been discovered. EPSS estimates a 0.77% chance of exploitation in the next 30 days.
Description
Shopware is an open source e-commerce software platform. An open redirect vulnerability has been discovered. Users may be arbitrary redirected due to incomplete URL handling in the shopware router. This issue has been resolved in version 5.7.7. There is no workaround and users are advised to upgrade as soon as possible.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Shopware | Shopware | >= 5.0.0, < 5.7.7 |
References
- https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022Patch, Vendor Advisory
- https://github.com/shopware/shopware/commit/a90046c765c57a46c4399dce17bd174253c32886Patch, Third Party Advisory
- https://github.com/shopware/shopware/security/advisories/GHSA-c53v-qmrx-93hgPatch, Third Party Advisory
- https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022Patch, Vendor Advisory
- https://github.com/shopware/shopware/commit/a90046c765c57a46c4399dce17bd174253c32886Patch, Third Party Advisory
- https://github.com/shopware/shopware/security/advisories/GHSA-c53v-qmrx-93hgPatch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-21651?
Shopware is an open source e-commerce software platform. An open redirect vulnerability has been discovered. Users may be arbitrary redirected due to incomplete URL handling in the shopware router. This issue has been resolved in version 5.7.7. There is no workaround and users are advised to upgrade as soon as possible.
How severe is CVE-2022-21651?
CVE-2022-21651 has a CVSS score of 6.1/10 (MEDIUM severity). The EPSS model estimates a 0.77% probability of exploitation in the next 30 days.
How do I fix CVE-2022-21651?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-21646SpiceDB is a database system for managing security-critical …8.1
- CVE-2022-21647CodeIgniter is an open source PHP full-stack web framework. …9.8
- CVE-2022-21648Latte is an open source template engine for PHP. Versions si…6.1
- CVE-2022-21649Convos is an open source multi-user chat that runs in a web …5.4
- CVE-2022-2165Insufficient data validation in URL formatting in Google Chr…4.3
- CVE-2022-21650Convos is an open source multi-user chat that runs in a web …5.4
- CVE-2022-21652Shopware is an open source e-commerce software platform. In …8.1
- CVE-2022-21653Jawn is an open source JSON parser. Extenders of the `org.ty…7.5
- CVE-2022-21654Envoy is an open source edge and service proxy, designed for…9.8
- CVE-2022-21655Envoy is an open source edge and service proxy, designed for…7.5
- CVE-2022-21656Envoy is an open source edge and service proxy, designed for…5.9
- CVE-2022-21657Envoy is an open source edge and service proxy, designed for…6.5
Are you affected by CVE-2022-21651?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST