CVE-2022-24879

Shopware is an open source e-commerce software platform. Versions prior to 5.7.9 are vulnerable to malfunction of cross-site request forgery (CSRF) token validation. Under certain circumstances, the CSRF tokens were not generated anew and not validated correctly. This issue is fixed in version 5.7.9. Users of older versions may attempt to mitigate the vulnerability by using the Shopware security plugin.

• CWE-352
• CWE-352

• https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022Vendor Advisory
• https://github.com/shopware/shopware/security/advisories/GHSA-pf38-v6qj-j23hThird Party Advisory
• https://www.shopware.com/en/changelog-sw5/#5-7-9Release Notes, Vendor Advisory
• https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022Vendor Advisory
• https://github.com/shopware/shopware/security/advisories/GHSA-pf38-v6qj-j23hThird Party Advisory
• https://www.shopware.com/en/changelog-sw5/#5-7-9Release Notes, Vendor Advisory

Published

Apr 28, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24873Shopware is an open source e-commerce software platform. Pri…6.1
• CVE-2022-24874Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-24875The CVEProject/cve-services is an open source project used t…7.5
• CVE-2022-24876GLPI is a Free Asset and IT Management Software package, tha…5.4
• CVE-2022-24877Flux is an open and extensible continuous delivery solution …8.8
• CVE-2022-24878Flux is an open and extensible continuous delivery solution …6.5
• CVE-2022-2488A vulnerability was found in WAVLINK WN535K2 and WN535K3 and…9.8
• CVE-2022-24880flask-session-captcha is a package which allows users to ext…5.3
• CVE-2022-24881Ballcat Codegen provides the function of online editing code…9.8
• CVE-2022-24882FreeRDP is a free implementation of the Remote Desktop Proto…7.5
• CVE-2022-24883FreeRDP is a free implementation of the Remote Desktop Proto…9.8
• CVE-2022-24884ecdsautils is a tiny collection of programs used for ECDSA (…7.5