CVE-2024-22407

CVSS 3.1 Score 6.5 of 10 (medium)

Details

Published Jan 16, 2024
Updated: Jan 24, 2024
CWE ID 284

Summary

CVE-2024-22407 is a vulnerability in the Shopware CMS that affects multiple versions of the software. The vulnerability resides in the state handler for orders, which fails to sufficiently verify user authorizations for actions that modify the payment, delivery, and/or order status. This implementation flaw allows users without 'write' permissions for orders to still be able to change the order state. To remediate this issue, users are advised to update to Shopware 6.5.7.4, while older versions can utilize corresponding security measures through a plugin. The potential danger of this vulnerability lies in unauthorized users being able to manipulate order states, posing a risk to the integrity of an organization's payment and delivery processes.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-22407 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options