CVE-2022-24746

Description

### Impact HTML injection possibility in voucher code form ## Patches Patched in 6.4.8.1, maintainers recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#shopware-6 ## Workarounds For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

How to fix CVE-2022-24746

To remediate CVE-2022-24746, upgrade the affected package to a fixed version below.

• —upgrade to 6.4.8.1 or later
• —upgrade to 6.4.8.1 or later
• —upgrade to 6.4.8.1 or later

Is CVE-2022-24746 being exploited?

Low — EPSS is 0.4%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

• from 0, < 6.4.8.1
• from 0, < 6.4.8.1
• from 0, < 6.4.8.1

CVSS scores

References (6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-24746
• PATCHgithub.com/shopware/platform
• WEBdocs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2022
• WEBdocs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2022?category=security-updates