CVE-2024-22406
Shopware vulnerability
- Published16 Jan 2024
Description
Shopware is an open headless commerce platform. The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the “aggregations” object. The ‘name’ field in this “aggregations” object is vulnerable SQL-injection and can be exploited using time-based SQL-queries. This issue has been addressed and users are advised to update to Shopware 6.5.7.4. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:LAffected products
Remediation
Frequently asked
Is CVE-2024-22406 being actively exploited?
CVE-2024-22406 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.64%.
How severe is CVE-2024-22406?
CVE-2024-22406 has a CVSS 3.1 base score of 9.3, rated critical. EPSS estimates a 0.64% probability of exploitation.
Which products are affected by CVE-2024-22406?
Affected products include Shopware.
How do I fix CVE-2024-22406?
Upgrade affected software to a fixed version, for example Shopware 6.5.7.4 or later, then confirm no affected versions remain in your inventory.
How Secuno handles this
Secuno correlates vulnerabilities like CVE-2024-22406 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.
Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.