GHSA-5834-xv5q-cgfw

Shopware vulnerable to persistent cross site scripting (XSS) in customer module

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-31148

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	shopware/shopware	>= 5.7.0, < 5.7.14	5.7.14

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Persistent XSS in customer module ### Patches We recommend updating to the current version 5.7.14. You can get the update to 5.7.14 regularly via the Auto-Updater or directly via the download overview. For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html ### References https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-07-2022

References

External links from the advisory. They lead to third-party sites.

https://github.com/shopware/shopware/security/advisories/GHSA-5834-xv5q-cgfw web
https://nvd.nist.gov/vuln/detail/CVE-2022-31148 advisory
https://github.com/shopware/shopware/commit/7875855005648fba7b39371a70816afae2e07daf web
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-07-2022 web
https://github.com/shopware/shopware package
https://www.shopware.com/en/changelog-sw5/#5-7-14 web