CVE-2023-34098
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Shopware is an open source e-commerce software. Due to an incorrect configuration in the `.htaccess` file, the configuration file of the Javascript (`themes/package-lock.json`) could be read in production environments, allowing attackers to determine the specific Shopware version in a deployment.
Risk Assessment
Attackers could use this information to carry out further attacks on the system. This exposes the organization to potential security threats.
Recommendation
Users are advised to update to version 5.7.18. There are no known workarounds for this vulnerability.
Original NVD description (English source)
Shopware is an open source e-commerce software. Due to an incorrect configuration in the `.htaccess` file, the configuration file of the Javascript could be read in production environments (`themes/package-lock.json`). With this information, the specific Shopware version in a deployment might be determined by an attacker, which could be used for further attacks. Users are advised to update to version 5.7.18. There are no known workarounds for this vulnerability.