CVE-2024-42354: 
PHP vulnerability analysis and mitigation

Shopware, an open commerce platform, disclosed a vulnerability (CVE-2024-42354) affecting versions prior to 6.6.5.1 and 6.5.8.13. The vulnerability relates to improper access control in the store-API's handling of ManyToMany associations. The issue was discovered and disclosed on August 8, 2024 (GitHub Advisory).

The vulnerability stems from the store-API's processing of entity fields, where fields need to be marked as ApiAware in the EntityDefinition to be exposed in the public API. The processing of the Criteria failed to properly consider ManyToMany associations, resulting in security protections being bypassed. The vulnerability has been assigned a CVSS v3.1 score of 5.9 MEDIUM (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) by NIST NVD (NVD).

While this vulnerability cannot be reproduced with default Shopware entities, it can be triggered through extensions. The primary impact is on data confidentiality, as indicated by the CVSS metrics showing high confidentiality impact but no impact on integrity or availability (GitHub Advisory).

The vulnerability requires network access and has high attack complexity. No privileges are required to exploit the vulnerability, though user interaction may be needed in some scenarios. The vulnerability affects the base software but can only be exploited through custom extensions (NVD).

Users are recommended to update to Shopware versions 6.6.5.1 or 6.5.8.13 to receive the security patch. For older versions (6.2, 6.3, and 6.4), security measures are available via a plugin. For optimal security, updating to the latest Shopware version is recommended (GitHub Advisory).