Injection Vulnerability in Shopware Open Commerce Platform

CVE-2024-42356

What is CVE-2024-42356?

The Shopware Open Commerce Platform has a serious vulnerability that permits the injection of the context variable into various Twig Templates. This flaw potentially allows attackers with administrative access to exploit template functionalities, accessing critical information such as current language and currency. By manipulating these templates, an attacker could execute any statically callable PHP function, posing a significant security risk. This vulnerability only affects those with access to the administration interface, as generic users cannot inject Twig code. It is crucial for users to upgrade to Shopware versions 6.6.5.1, 6.5.8.13, or install relevant security measures through a plugin for earlier versions to mitigate this risk.

References