Information Exposure Affecting shopware/platform package, versions >=6.1.0, <6.4.18.1
Threat Intelligence
EPSS
0.1% (42nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-SHOPWAREPLATFORM-3233640
- published 18 Jan 2023
- disclosed 18 Jan 2023
- credit Unknown
Introduced: 18 Jan 2023
CVE-2023-22733 Open this link in a new tabHow to fix?
Upgrade shopware/platform to version 6.4.18.1 or higher.
Overview
shopware/platform is a Shopware e-commerce core.
Affected versions of this package are vulnerable to Information Exposure in the output of the log module, which can contain password reset email text. An attacker with access to either the local system logs or a centralized logging store can access these logs.
Workaround
This vulnerability can be avoided by removing the log module ACL rights from all relevant users, or disabling logging.
CVSS Scores
version 3.1