CVE-2022-24748 Details

A vulnerability exists in Shopware versions through 6.3.1.0, allowing users to modify customer data and create orders without the necessary application permissions. This issue stems from inadequate validation of API routes, enabling unauthorized actions. Users are encouraged to update to version 6.4.8.2, which addresses this vulnerability. For those on older versions 6.1, 6.2, and 6.3, a plugin is available to implement the required security measures.

Users should update to Shopware version 6.4.8.2. This update can be obtained through the Auto-Updater or directly from the Shopware download overview. For users on older versions 6.1, 6.2, and 6.3, a plugin is available to implement the necessary security measures.