Shopware improper mail validation vulnerability
Impact
The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| From 5.1.4 before 5.7.18Ecosystem versions | 5.7.18 |
Version evidence: OSV · GHSA-gh66-fp7j-98v5
View original version evidence (95 explicit versions)
Original source description
Impact
The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts.
Patches
We recommend updating to the current version 5.7.18. You can get the update to 5.7.18 regularly via the Auto-Updater or directly via the release page. https://github.com/shopware5/shopware/releases/tag/v5.7.18
For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html
References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023
References
- Security advisory github.com/shopware/shopware/security/advisories/GHSA-gh66-fp7j-98v5
- Security advisory github.com/shopware5/shopware/security/advisories/GHSA-gh66-fp7j-98v5
- Security advisory nvd.nist.gov/vuln/detail/CVE-2023-34099
- Patch github.com/shopware5/shopware/commit/39cc714d9a0be33b43877044d0b88ea3c6b43f3d
- Security advisory docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023
- Source reference github.com/shopware5/shopware
- Release notes www.shopware.com/en/changelog-sw5/