CVE-2024-42357

Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the `aggregations` object. The `name` field in this `aggregations` object is vulnerable SQL-injection and can be exploited using SQL parameters. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.1, 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin.

• CWE-89
• CWE-89

• https://github.com/shopware/core/commit/63c05615694790f5790a04ef889f42b764fa53c9Patch
• https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442fPatch
• https://github.com/shopware/shopware/commit/57ea2f3c59483cf7c0f853e7a0d68c23ded1fe5bPatch
• https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0acPatch
• https://github.com/shopware/shopware/security/advisories/GHSA-p6w9-r443-r752Vendor Advisory

Published

Aug 8, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-42351Galaxy is a free, open-source system for analyzing data, aut…9.1
• CVE-2024-42352Nuxt is a free and open-source framework to create full-stac…7.5
• CVE-2024-42353WebOb provides objects for HTTP requests and responses. When…6.1
• CVE-2024-42354Shopware is an open commerce platform. The store-API works w…5.9
• CVE-2024-42355Shopware, an open ecommerce platform, has a new Twig Tag `sw…9.8
• CVE-2024-42356Shopware is an open commerce platform. Prior to versions 6.6…7.2
• CVE-2024-42358PDFio is a simple C library for reading and writing PDF file…5.5
• CVE-2024-4236A vulnerability, which was classified as critical, has been …8.8
• CVE-2024-42360SequenceServer lets you rapidly set up a BLAST+ server with …9.8
• CVE-2024-42361Hertzbeat is an open source, real-time monitoring system. He…9.8
• CVE-2024-42362Hertzbeat is an open source, real-time monitoring system. He…8.8
• CVE-2024-42363Prior to 3385, the user-controlled role parameter enters the…8.8