CVE-2023-22733

Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions the log module would write out all kind of sent mails. An attacker with access to either the local system logs or a centralized logging store may have access to other users accounts. This issue has been addressed in version 6.4.18.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. Users unable to upgrade may remove from all users the log module ACL rights or disable logging.

• CWE-532

• https://developer.shopware.com/docs/guides/hosting/performance/performance-tweaks#loggingVendor Advisory
• https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updatesPatch, Vendor Advisory
• https://github.com/shopware/platform/commit/407a83063d7141c1a626441799c3ebef79498c07Patch, Third Party Advisory
• https://github.com/shopware/platform/security/advisories/GHSA-7cp7-jfp6-jh4fThird Party Advisory
• https://developer.shopware.com/docs/guides/hosting/performance/performance-tweaks#loggingVendor Advisory
• https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updatesPatch, Vendor Advisory
• https://github.com/shopware/platform/commit/407a83063d7141c1a626441799c3ebef79498c07Patch, Third Party Advisory
• https://github.com/shopware/platform/security/advisories/GHSA-7cp7-jfp6-jh4fThird Party Advisory

Published

Jan 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22728Silverstripe Framework is the Model-View-Controller framewor…4.3
• CVE-2023-22729Silverstripe Framework is the Model-View-Controller framewor…6.1
• CVE-2023-2273Rapid7 Insight Agent token handler versions 3.2.6 and below,…7.5
• CVE-2023-22730Shopware is an open source commerce platform based on Symfon…7.5
• CVE-2023-22731Shopware is an open source commerce platform based on Symfon…8.8
• CVE-2023-22732Shopware is an open source commerce platform based on Symfon…9.8
• CVE-2023-22734Shopware is an open source commerce platform based on Symfon…7.5
• CVE-2023-22735Zulip is an open-source team collaboration tool. In versions…4.6
• CVE-2023-22736Argo CD is a declarative, GitOps continuous delivery tool fo…8.5
• CVE-2023-22737wire-server provides back end services for Wire, a team comm…6.5
• CVE-2023-22738vantage6 is a privacy preserving federated learning infrastr…6.5
• CVE-2023-22739Discourse is an open source platform for community discussio…6.5