CVE-2025-30151 (GCVE-0-2025-30151)
Vulnerability from cvelistv5 – Published: 2025-04-08 13:46 – Updated: 2025-04-08 18:47
VLAI?
Title
Shopware allows Denial Of Service via password length
Summary
Shopware is an open commerce platform. It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Severity ?
7.5 (High)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-30151",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-08T18:47:17.395503Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-08T18:47:54.011Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "shopware",
"vendor": "shopware",
"versions": [
{
"status": "affected",
"version": "\u003c 6.5.8.17"
},
{
"status": "affected",
"version": "\u003e= 6.6.0.0, \u003c 6.6.10.3"
},
{
"status": "affected",
"version": "\u003e= 6.7.0.0-rc1, \u003c 6.7.0.0-rc2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Shopware is an open commerce platform. It\u0027s possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-08T13:46:30.629Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/shopware/shopware/security/advisories/GHSA-cgfj-hj93-rmh2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/shopware/shopware/security/advisories/GHSA-cgfj-hj93-rmh2"
}
],
"source": {
"advisory": "GHSA-cgfj-hj93-rmh2",
"discovery": "UNKNOWN"
},
"title": "Shopware allows Denial Of Service via password length"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-30151",
"datePublished": "2025-04-08T13:46:30.629Z",
"dateReserved": "2025-03-17T12:41:42.565Z",
"dateUpdated": "2025-04-08T18:47:54.011Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-30151\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2025-04-08T14:15:34.737\",\"lastModified\":\"2025-09-10T15:26:36.313\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Shopware is an open commerce platform. It\u0027s possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.\"},{\"lang\":\"es\",\"value\":\"Shopware es una plataforma de comercio abierta. Es posible pasar contrase\u00f1as largas que provoquen una denegaci\u00f3n de servicio a trav\u00e9s de formularios de Storefront o de la API de la tienda. Esta vulnerabilidad se corrigi\u00f3 en las versiones 6.6.10.3 o 6.5.8.17. Para versiones anteriores a la 6.4, las medidas de seguridad correspondientes tambi\u00e9n est\u00e1n disponibles mediante un complemento. Para disfrutar de todas las funciones, recomendamos actualizar a la \u00faltima versi\u00f3n de Shopware.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.5.8.17\",\"matchCriteriaId\":\"F0D12C54-6012-4FC8-9171-8B916D4D7EEA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.0.0\",\"versionEndExcluding\":\"6.6.10.3\",\"matchCriteriaId\":\"A215DE35-2543-4191-B0C7-0DEFE195012F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:shopware:shopware:6.7.0.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"24764539-D914-4560-B02A-39B381DDB63A\"}]}]}],\"references\":[{\"url\":\"https://github.com/shopware/shopware/security/advisories/GHSA-cgfj-hj93-rmh2\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-30151\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-08T18:47:17.395503Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-08T18:47:26.069Z\"}}], \"cna\": {\"title\": \"Shopware allows Denial Of Service via password length\", \"source\": {\"advisory\": \"GHSA-cgfj-hj93-rmh2\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"shopware\", \"product\": \"shopware\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 6.5.8.17\"}, {\"status\": \"affected\", \"version\": \"\u003e= 6.6.0.0, \u003c 6.6.10.3\"}, {\"status\": \"affected\", \"version\": \"\u003e= 6.7.0.0-rc1, \u003c 6.7.0.0-rc2\"}]}], \"references\": [{\"url\": \"https://github.com/shopware/shopware/security/advisories/GHSA-cgfj-hj93-rmh2\", \"name\": \"https://github.com/shopware/shopware/security/advisories/GHSA-cgfj-hj93-rmh2\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Shopware is an open commerce platform. It\u0027s possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20: Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2025-04-08T13:46:30.629Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-30151\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-08T18:47:54.011Z\", \"dateReserved\": \"2025-03-17T12:41:42.565Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2025-04-08T13:46:30.629Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…