{"api_version":"1","generated_at":"2026-07-23T10:29:06+00:00","cve":"CVE-2022-24871","urls":{"html":"https://cve.report/CVE-2022-24871","api":"https://cve.report/api/cve/CVE-2022-24871.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-24871","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-24871"},"summary":{"title":"CVE-2022-24871","description":"Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the Admin SDK functionality on the server to read or update internal resources. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue.","state":"PUBLIC","assigner":"security-advisories@github.com","published_at":"2022-04-20 19:15:00","updated_at":"2022-04-28 18:34:00"},"problem_types":["CWE-918"],"metrics":[],"references":[{"url":"https://github.com/shopware/platform/security/advisories/GHSA-7gm7-8q8v-9gf2","name":"https://github.com/shopware/platform/security/advisories/GHSA-7gm7-8q8v-9gf2","refsource":"CONFIRM","tags":[],"title":"Server-Side Request Forgery (SSRF) in Admin SDK · Advisory · shopware/platform · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77c","name":"https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77c","refsource":"MISC","tags":[],"title":"NEXT-21034 - Dont restore permissions · shopware/platform@083765e · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022","name":"https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022","refsource":"MISC","tags":[],"title":"Shopware 6 - Security Updates - Security Update 04/2022","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24871","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24871","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"24871","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"shopware","cpe5":"shopware","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security-advisories@github.com","ID":"CVE-2022-24871","STATE":"PUBLIC","TITLE":"Server-Side Request Forgery (SSRF) in Shopware"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"platform","version":{"version_data":[{"version_value":"< 6.4.10.1"}]}}]},"vendor_name":"shopware"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the Admin SDK functionality on the server to read or update internal resources. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue."}]},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-918: Server-Side Request Forgery (SSRF)"}]}]},"references":{"reference_data":[{"name":"https://github.com/shopware/platform/security/advisories/GHSA-7gm7-8q8v-9gf2","refsource":"CONFIRM","url":"https://github.com/shopware/platform/security/advisories/GHSA-7gm7-8q8v-9gf2"},{"name":"https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77c","refsource":"MISC","url":"https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77c"},{"name":"https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022","refsource":"MISC","url":"https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022"}]},"source":{"advisory":"GHSA-7gm7-8q8v-9gf2","discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2022-04-20 19:15:00","lastModifiedDate":"2022-04-28 18:34:00","problem_types":["CWE-918"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":1.2,"impactScore":4.2},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":5.5},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*","versionEndExcluding":"6.4.10.1","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2022","CveId":"24871","Ordinal":"228250","Title":"CVE-2022-24871","CVE":"CVE-2022-24871","Year":"2022"},"notes":[{"CveYear":"2022","CveId":"24871","Ordinal":"1","NoteData":"** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.","Type":"Description","Title":null}]}}}