CVE-2024-42354

Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON. Prior to versions 6.6.5.1 and 6.5.8.13, the processing of the Criteria did not considered ManyToMany associations and so they were not considered properly and the protections didn't get used. This issue cannot be reproduced with the default entities by Shopware, but can be triggered with extensions. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin.

• CWE-284

• https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442fPatch
• https://github.com/shopware/core/commit/d35ee2eda5c995faeb08b3dad127eab65c64e2a2Patch
• https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0acPatch
• https://github.com/shopware/shopware/commit/ad83d38809df457efef21c37ce0996430334bf01Patch
• https://github.com/shopware/shopware/security/advisories/GHSA-hhcq-ph6w-494gVendor Advisory

Published

Aug 8, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-42349FOG is a cloning/imaging/rescue suite/inventory management s…5.3
• CVE-2024-4235A vulnerability classified as problematic was found in Netge…4.9
• CVE-2024-42350Biscuit is an authorization token with decentralized verific…3
• CVE-2024-42351Galaxy is a free, open-source system for analyzing data, aut…9.1
• CVE-2024-42352Nuxt is a free and open-source framework to create full-stac…7.5
• CVE-2024-42353WebOb provides objects for HTTP requests and responses. When…6.1
• CVE-2024-42355Shopware, an open ecommerce platform, has a new Twig Tag `sw…9.8
• CVE-2024-42356Shopware is an open commerce platform. Prior to versions 6.6…7.2
• CVE-2024-42357Shopware is an open commerce platform. Prior to versions 6.6…9.8
• CVE-2024-42358PDFio is a simple C library for reading and writing PDF file…5.5
• CVE-2024-4236A vulnerability, which was classified as critical, has been …8.8
• CVE-2024-42360SequenceServer lets you rapidly set up a BLAST+ server with …9.8