CVE-2023-34099mediumCWE-754

CVE-2023-34099: medium-severity vulnerability in shopware

Improper mail validation in Shopware

Published · Updated

Follow this CVE+ Monitor shopware+ Monitor shopware/shopware

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.6%
Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. This issue has been addressed in version 5.7.18 and users are advised to update. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
shopware · shopware
Related CVEs — shopware

In the same product, most dangerous first.

CVE-2021-32712MEDIUMInformation leakage in Error HandlerEPSS 1.1%CVE-2022-24892MEDIUMMultiple valid tokens for password reset in ShopwareEPSS 0.9%CVE-2024-42355HIGHShopware vulnerable to Server Side Template Injection in Twig using deprecation silence tagEPSS 0.9%CVE-2022-21652LOWInsufficient Session Expiration in shopwareEPSS 0.8%CVE-2022-36102MEDIUMAcess control list bypassed via crafted specific URLsEPSS 0.8%CVE-2022-21651MEDIUMOpen redirect in shopwareEPSS 0.8%