CVE-2023-34098

Shopware is an open source e-commerce software. Due to an incorrect configuration in the `.htaccess` file, the configuration file of the Javascript could be read in production environments (`themes/package-lock.json`). With this information, the specific Shopware version in a deployment might be determined by an attacker, which could be used for further attacks. Users are advised to update to version 5.7.18. There are no known workarounds for this vulnerability.
Configurations

Configuration 1 (hide)

cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*

History

05 Jul 2023, 16:25

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 5.3
CPE cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*
First Time Shopware shopware
Shopware
References (MISC) https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023 - (MISC) https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023 - Patch, Vendor Advisory
References (MISC) https://www.shopware.com/en/changelog-sw5/#5-7-18 - (MISC) https://www.shopware.com/en/changelog-sw5/#5-7-18 - Release Notes
References (MISC) https://github.com/shopware5/shopware/commit/b3518c8d9562a38615d638f31f79829f6e2f4b6a - (MISC) https://github.com/shopware5/shopware/commit/b3518c8d9562a38615d638f31f79829f6e2f4b6a - Patch
References (MISC) https://github.com/shopware/shopware/security/advisories/GHSA-q97c-2mh3-pgw9 - (MISC) https://github.com/shopware/shopware/security/advisories/GHSA-q97c-2mh3-pgw9 - Vendor Advisory

27 Jun 2023, 17:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-06-27 17:15

Updated : 2024-02-28 20:13


NVD link : CVE-2023-34098

Mitre link : CVE-2023-34098

CVE.ORG link : CVE-2023-34098


JSON object : View

Products Affected

shopware

  • shopware
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor