CVE-2017-15374 Shopware XSS Vulnerability
Remote attackers can inject malicious scripts into customer or order fields, leading to persistent XSS and potential admin account takeover in Shopware.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2017-15374?
CVE-2017-15374 is a medium-severity cross-site scripting vulnerability in Shopware Shopware, published on 16 Oct 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to provoke persistent execution in the customer and orders section of the backend. The execution occurs in the administrator backend listing when processing a preview of the customers (kunden) or orders (bestellungen). The injection can be performed interactively via user registration or by manipulation of the order information inputs. The issue can be exploited by low privileged user accounts against higher privileged (admin or moderator) accounts.
Weakness: CWE-79
Which versions are affected by CVE-2017-15374?
2 open source packages ship an affected version, including shopware/shopware. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
shopware/shopware Packagist | From 5.2.5 to 5.3 | None |
shopware/shopware Packagist | From 5.2.5 to 5.3 | None |
Products include Shopware Shopware.
How do I fix CVE-2017-15374?
No fix has been published for CVE-2017-15374 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2017-15374 being exploited?
There is no known exploitation of CVE-2017-15374 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Shopware Shopware
- CVE-2023-22731 Improper Control of Generation of Code in Twig rendered views in shopware
- CVE-2016-3109 Shopware RCE Vulnerability
- CVE-2024-22406 Blind SQL-injection in DAL aggregations in Shopware
- CVE-2021-32711 Leak of information via Store-API
- CVE-2026-31887 Shopware unauthenticated data extraction possible through store-api.order endpoint
Sources
Also known as GHSA-mvrx-cmqw-2jgj.