Improper Input Newsletter subscription option validation in shopware

CVE-2023-22734

What is CVE-2023-22734?

A vulnerability in the Shopware platform's newsletter feature allows users to bypass the double opt-in process, resulting in potential inconsistencies in newsletter subscriptions. This flaw arises due to improper validation checks during the opt-in process. Operators are strongly encouraged to upgrade to version 6.4.18.1 or higher, where this issue has been addressed. For users unable to update, alternative security measures are available through dedicated plugins for versions 6.1, 6.2, and 6.3. Additionally, users have the option to disable newsletter registration altogether to mitigate risk.

References