CVE-2023-34098

Shopware is an open source e-commerce software. Due to an incorrect configuration in the `.htaccess` file, the configuration file of the Javascript could be read in production environments (`themes/package-lock.json`). With this information, the specific Shopware version in a deployment might be determined by an attacker, which could be used for further attacks. Users are advised to update to version 5.7.18. There are no known workarounds for this vulnerability.

• CWE-200

• https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023Patch, Vendor Advisory
• https://github.com/shopware/shopware/security/advisories/GHSA-q97c-2mh3-pgw9Vendor Advisory
• https://github.com/shopware5/shopware/commit/b3518c8d9562a38615d638f31f79829f6e2f4b6aPatch
• https://www.shopware.com/en/changelog-sw5/#5-7-18Release Notes
• https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023Patch, Vendor Advisory
• https://github.com/shopware/shopware/security/advisories/GHSA-q97c-2mh3-pgw9Vendor Advisory
• https://github.com/shopware5/shopware/commit/b3518c8d9562a38615d638f31f79829f6e2f4b6aPatch
• https://www.shopware.com/en/changelog-sw5/#5-7-18Release Notes

Published

Jun 27, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-34092Vite provides frontend tooling. Prior to versions 2.9.16, 3.…7.5
• CVE-2023-34093Strapi is an open-source headless content management system.…7.1
• CVE-2023-34094ChuanhuChatGPT is a graphical user interface for ChatGPT and…5.3
• CVE-2023-34095cpdb-libs provides frontend and backend libraries for the Co…9.8
• CVE-2023-34096Thruk is a multibackend monitoring webinterface which curren…8.8
• CVE-2023-34097hoppscotch is an open source API development ecosystem. In v…8.8
• CVE-2023-34099Shopware is an open source e-commerce software. The mail val…5.3
• CVE-2023-3410The Bricks theme for WordPress is vulnerable to Stored Cross…5.4
• CVE-2023-34100Contiki-NG is an open-source, cross-platform operating syste…6.5
• CVE-2023-34101Contiki-NG is an operating system for internet of things dev…9.1
• CVE-2023-34102Avo is an open source ruby on rails admin panel creation fra…8.8
• CVE-2023-34103Avo is an open source ruby on rails admin panel creation fra…5.4