CVE-2023-22734

描述

### Impact The newsletter double opt-in validation was not checked properly, and it was possible to skip the complete double opt in process. ### Patches The problem has been fixed with 6.4.18.1 ### Workarounds For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. Or disable the newsletter registration completely. ### References https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates

如何修補 CVE-2023-22734

要修補 CVE-2023-22734,請將受影響套件升級到下列已修補版本。

• —升級至 6.4.18.1 或更新版本
• —升級至 6.4.18.1 或更新版本

CVE-2023-22734 正在被利用嗎?

低 — EPSS 為 0.6%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 6.4.18.1
• from 0, < 6.4.18.1

CVSS 分數

參考連結(5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-22734
• PATCHgithub.com/shopware/platform
• WEBdocs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates
• WEBgithub.com/shopware/platform/commit/f5a95ee2bcf1e546878450963ef1d9886e59a620