CVE-2022-36101: 
PHP vulnerability analysis and mitigation

Shopware, an open source e-commerce software, was found to contain a sensitive data exposure vulnerability (CVE-2022-36101) affecting versions 5.0.0 to 5.7.14. The vulnerability was discovered and disclosed in September 2022, where the customer detail view in the backend administration contained sensitive data including hashed passwords and session IDs (Shopware Docs).

The vulnerability has been assigned a CVSS v3.1 score of 5.3 (MEDIUM), indicating a moderate severity level. The issue specifically involved the exposure of sensitive information in the customer detail view of the backend administration, where hashed passwords and session IDs were inadvertently included in the response (NVD).

The vulnerability could allow attackers with access to the backend administration to view sensitive customer data, including hashed passwords and session IDs, potentially compromising user account security (Shopware Docs).

The vulnerability was patched in Shopware version 5.7.15, where the sensitive fields are now explicitly unset in the customer detail view. Users are advised to update either through the Auto-Updater or directly via the download overview. For users unable to update immediately, a security plugin is available as an alternative mitigation measure (Shopware Docs).