{"api_version":"1","generated_at":"2026-07-23T12:07:21+00:00","cve":"CVE-2022-24872","urls":{"html":"https://cve.report/CVE-2022-24872","api":"https://cve.report/api/cve/CVE-2022-24872.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-24872","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-24872"},"summary":{"title":"CVE-2022-24872","description":"Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by admin-api are still usable within normal user session. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue.","state":"PUBLIC","assigner":"security-advisories@github.com","published_at":"2022-04-20 20:15:00","updated_at":"2022-05-03 15:58:00"},"problem_types":["CWE-732"],"metrics":[],"references":[{"url":"https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77c","name":"https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77c","refsource":"MISC","tags":[],"title":"NEXT-21034 - Dont restore permissions · shopware/platform@083765e · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022","name":"https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022","refsource":"MISC","tags":[],"title":"Shopware 6 - Security Updates - Security Update 04/2022","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/shopware/platform/security/advisories/GHSA-9wrv-g75h-8ccc","name":"https://github.com/shopware/platform/security/advisories/GHSA-9wrv-g75h-8ccc","refsource":"CONFIRM","tags":[],"title":"Improper Access Control in SalesChannelContext/Cart · Advisory · shopware/platform · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24872","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24872","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"24872","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"shopware","cpe5":"shopware","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security-advisories@github.com","ID":"CVE-2022-24872","STATE":"PUBLIC","TITLE":"Improper Access Control in shopware"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"platform","version":{"version_data":[{"version_value":"< 6.4.10.1"}]}}]},"vendor_name":"shopware"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by admin-api are still usable within normal user session. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue."}]},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-732: Incorrect Permission Assignment for Critical Resource"}]}]},"references":{"reference_data":[{"name":"https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77c","refsource":"MISC","url":"https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77c"},{"name":"https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022","refsource":"MISC","url":"https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022"},{"name":"https://github.com/shopware/platform/security/advisories/GHSA-9wrv-g75h-8ccc","refsource":"CONFIRM","url":"https://github.com/shopware/platform/security/advisories/GHSA-9wrv-g75h-8ccc"}]},"source":{"advisory":"GHSA-9wrv-g75h-8ccc","discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2022-04-20 20:15:00","lastModifiedDate":"2022-05-03 15:58:00","problem_types":["CWE-732"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":5.5},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*","versionEndExcluding":"6.4.10.1","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2022","CveId":"24872","Ordinal":"228277","Title":"CVE-2022-24872","CVE":"CVE-2022-24872","Year":"2022"},"notes":[{"CveYear":"2022","CveId":"24872","Ordinal":"1","NoteData":"** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.","Type":"Description","Title":null}]}}}