Denial of Service Vulnerability in Shopware Open Commerce Platform
CVE-2025-30151

7.5HIGH

Key Information:

Vendor

Shopware

Status
Shopware
Vendor
CVE Published:
8 April 2025

What is CVE-2025-30151?

The Shopware open commerce platform is vulnerable to Denial of Service attacks due to improper handling of long passwords submitted through forms in the Storefront and Store API. Attackers can exploit this flaw, causing disruptions in service availability. The issue has been addressed in Shopware version 6.6.10.3 and 6.5.8.17. For users of the older 6.4 versions, corresponding security measures can be implemented through available plugins. For optimal security and functionality, users should upgrade to the latest version of Shopware.

Affected Version(s)

shopware < 6.5.8.17 < 6.5.8.17

shopware >= 6.6.0.0, < 6.6.10.3 < 6.6.0.0, 6.6.10.3

shopware >= 6.7.0.0-rc1, < 6.7.0.0-rc2 < 6.7.0.0-rc1, 6.7.0.0-rc2

References

https://github.com/shopware/shopware/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.