Shopware race condition bypasses voucher restrictions
The advisory, in context
A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intended voucher restrictions and exceed usage limitations.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases through 6.6.10.4 (inclusive)
No fix recorded for this interval.
153 explicitly affected versions
6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.10.0, 6.4.10.1, 6.4.11.0, 6.4.11.1, 6.4.12.0, 6.4.13.0, 6.4.14.0, 6.4.15.0, 6.4.15.1, 6.4.15.2, 6.4.16.0, 6.4.16.1, 6.4.17.0, 6.4.17.1, 6.4.17.2, 6.4.18.0, 6.4.18.1, 6.4.19.0, 6.4.2.0, 6.4.2.1, 6.4.20.0, 6.4.20.1, 6.4.20.2, 6.4.3.0, 6.4.3.1, 6.4.4.0, 6.4.4.1, 6.4.5.0, 6.4.5.1, 6.4.6.0, 6.4.6.1, 6.4.7.0, 6.4.8.0, 6.4.8.1, 6.4.8.2, 6.4.9.0, 6.5.0.0, 6.5.0.0-rc1, 6.5.0.0-rc2, 6.5.0.0-rc3, 6.5.0.0-rc4, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3, v6.5.1.0, v6.5.1.1, v6.5.2.0, v6.5.2.1, v6.5.3.0, v6.5.3.1, v6.5.3.2, v6.5.3.3, v6.5.4.0, v6.5.4.1, v6.5.5.0, v6.5.5.1, v6.5.5.2, v6.5.6.0, v6.5.6.1, v6.5.7.0, v6.5.7.1, v6.5.7.2, v6.5.7.3, v6.5.7.4, v6.5.8.0, v6.5.8.1, v6.5.8.10, v6.5.8.11, v6.5.8.12, v6.5.8.13, v6.5.8.14, v6.5.8.15, v6.5.8.16, v6.5.8.17, v6.5.8.18, v6.5.8.19, v6.5.8.2, v6.5.8.3, v6.5.8.4, v6.5.8.5, v6.5.8.6, v6.5.8.7, v6.5.8.8, v6.5.8.9, v6.6.0.0, v6.6.0.0-rc1, v6.6.0.0-rc2, v6.6.0.0-rc3, v6.6.0.0-rc4, v6.6.0.0-rc5, v6.6.0.0-rc6, v6.6.0.0-rc7, v6.6.0.1, v6.6.0.2, v6.6.0.3, v6.6.1.0, v6.6.1.1, v6.6.1.2, v6.6.10.0, v6.6.10.1, v6.6.10.2, v6.6.10.3, v6.6.10.4, v6.6.2.0, v6.6.3.0, v6.6.3.1, v6.6.4.0, v6.6.4.1, v6.6.5.0, v6.6.5.1, v6.6.6.0, v6.6.6.1, v6.6.7.0, v6.6.7.1, v6.6.8.0, v6.6.8.1, v6.6.8.2, v6.6.9.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "6.6.10.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"6.3.0.0",
"6.3.0.1",
"6.3.0.2",
"6.3.1.0",
"6.3.1.1",
"6.3.2.0",
"6.3.2.1",
"6.3.3.0",
"6.3.3.1",
"6.3.4.0",
"6.3.4.1",
"6.3.5.0",
"6.3.5.1",
"6.3.5.2",
"6.3.5.3",
"6.3.5.4",
"6.4.0.0",
"6.4.0.0-RC1",
"6.4.1.0",
"6.4.1.1",
"6.4.1.2",
"6.4.10.0",
"6.4.10.1",
"6.4.11.0",
"6.4.11.1",
"6.4.12.0",
"6.4.13.0",
"6.4.14.0",
"6.4.15.0",
"6.4.15.1",
"6.4.15.2",
"6.4.16.0",
"6.4.16.1",
"6.4.17.0",
"6.4.17.1",
"6.4.17.2",
"6.4.18.0",
"6.4.18.1",
"6.4.19.0",
"6.4.2.0",
"6.4.2.1",
"6.4.20.0",
"6.4.20.1",
"6.4.20.2",
"6.4.3.0",
"6.4.3.1",
"6.4.4.0",
"6.4.4.1",
"6.4.5.0",
"6.4.5.1",
"6.4.6.0",
"6.4.6.1",
"6.4.7.0",
"6.4.8.0",
"6.4.8.1",
"6.4.8.2",
"6.4.9.0",
"6.5.0.0",
"6.5.0.0-rc1",
"6.5.0.0-rc2",
"6.5.0.0-rc3",
"6.5.0.0-rc4",
"v6.0.0+ea2",
"v6.1.0",
"v6.1.0-rc1",
"v6.1.0-rc2",
"v6.1.0-rc3",
"v6.1.0-rc4",
"v6.1.1",
"v6.1.2",
"v6.1.3",
"v6.1.4",
"v6.1.5",
"v6.1.6",
"v6.2.0",
"v6.2.0-RC1",
"v6.2.1",
"v6.2.2",
"v6.2.3",
"v6.5.1.0",
"v6.5.1.1",
"v6.5.2.0",
"v6.5.2.1",
"v6.5.3.0",
"v6.5.3.1",
"v6.5.3.2",
"v6.5.3.3",
"v6.5.4.0",
"v6.5.4.1",
"v6.5.5.0",
"v6.5.5.1",
"v6.5.5.2",
"v6.5.6.0",
"v6.5.6.1",
"v6.5.7.0",
"v6.5.7.1",
"v6.5.7.2",
"v6.5.7.3",
"v6.5.7.4",
"v6.5.8.0",
"v6.5.8.1",
"v6.5.8.10",
"v6.5.8.11",
"v6.5.8.12",
"v6.5.8.13",
"v6.5.8.14",
"v6.5.8.15",
"v6.5.8.16",
"v6.5.8.17",
"v6.5.8.18",
"v6.5.8.19",
"v6.5.8.2",
"v6.5.8.3",
"v6.5.8.4",
"v6.5.8.5",
"v6.5.8.6",
"v6.5.8.7",
"v6.5.8.8",
"v6.5.8.9",
"v6.6.0.0",
"v6.6.0.0-rc1",
"v6.6.0.0-rc2",
"v6.6.0.0-rc3",
"v6.6.0.0-rc4",
"v6.6.0.0-rc5",
"v6.6.0.0-rc6",
"v6.6.0.0-rc7",
"v6.6.0.1",
"v6.6.0.2",
"v6.6.0.3",
"v6.6.1.0",
"v6.6.1.1",
"v6.6.1.2",
"v6.6.10.0",
"v6.6.10.1",
"v6.6.10.2",
"v6.6.10.3",
"v6.6.10.4",
"v6.6.2.0",
"v6.6.3.0",
"v6.6.3.1",
"v6.6.4.0",
"v6.6.4.1",
"v6.6.5.0",
"v6.6.5.1",
"v6.6.6.0",
"v6.6.6.1",
"v6.6.7.0",
"v6.6.7.1",
"v6.6.8.0",
"v6.6.8.1",
"v6.6.8.2",
"v6.6.9.0"
]
}