CVE-2022-24871

Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the Admin SDK functionality on the server to read or update internal resources. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue.

• CWE-918
• CWE-918

• https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022Patch, Third Party Advisory
• https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77cPatch, Third Party Advisory
• https://github.com/shopware/platform/security/advisories/GHSA-7gm7-8q8v-9gf2Third Party Advisory
• https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022Patch, Third Party Advisory
• https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77cPatch, Third Party Advisory
• https://github.com/shopware/platform/security/advisories/GHSA-7gm7-8q8v-9gf2Third Party Advisory

Published

Apr 20, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24866Discourse Assign is a plugin for assigning users to a topic …4.3
• CVE-2022-24867GLPI is a Free Asset and IT Management Software package, tha…7.5
• CVE-2022-24868GLPI is a Free Asset and IT Management Software package, tha…5.4
• CVE-2022-24869GLPI is a Free Asset and IT Management Software package, tha…5.4
• CVE-2022-2487A vulnerability has been found in WAVLINK WN535K2 and WN535K…9.8
• CVE-2022-24870Combodo iTop is a web based IT Service Management tool. In 3…5.4
• CVE-2022-24872Shopware is an open commerce platform based on Symfony Frame…8.1
• CVE-2022-24873Shopware is an open source e-commerce software platform. Pri…6.1
• CVE-2022-24874Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-24875The CVEProject/cve-services is an open source project used t…7.5
• CVE-2022-24876GLPI is a Free Asset and IT Management Software package, tha…5.4
• CVE-2022-24877Flux is an open and extensible continuous delivery solution …8.8