CVE-2022-21651

Open redirect in shopware

6.8 MediumFix available

Shopware is an open source e-commerce software platform. An open redirect vulnerability has been discovered. Users may be arbitrary redirected due to incomplete URL handling in the shopware router. This issue has been resolved in version 5.7.7. There is no workaround and users are advised to upgrade as soon as possible.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.80%Down 0.2 points since Feb 8, 2022

What each source reports

CVE List Score used 6.8

Open redirect in shopware

Record: CVE-2022-21651
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Weakness: CWE-601
Updated: 2026-11-02

EUVDEUVD-2022-0553 6.8

Record: EUVD-2022-0553
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-c53v-qmrx-93hg 6.8

Open redirect in shopware

Impact

Arbitrary redirect while using certain URLs

Patches

We recommend updating to the current version 5.7.7. You can get the update to 5.7.7 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

References

https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022

Record: GHSA-c53v-qmrx-93hg
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Weakness: CWE-601
Updated: 2026-11-02

NVD 6.8

Record: CVE-2022-21651
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness: CWE-601
Updated: 2026-11-02

OSVGHSA-c53v-qmrx-93hg 6.8

Open redirect in shopware

Impact

Arbitrary redirect while using certain URLs

Patches

We recommend updating to the current version 5.7.7. You can get the update to 5.7.7 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

References

https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022

Record: GHSA-c53v-qmrx-93hg
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Weakness: CWE-601
Updated: 2026-11-02

Affected products

shopware

Affected packages

Affected packages
Package	Affected	Fixed
`shopware/shopware` Packagist	5.0.0 up to 5.7.7	5.7.7
`shopware/shopware` Packagist	5.0.0 up to 5.7.7, plus listed versions 5.3.0v5.0.0v5.0.1v5.0.2v5.0.2-RC1 Show 45 moreShow less v5.0.3v5.0.3-RC1v5.0.4v5.0.4-RC1v5.1.0v5.1.0-RC2v5.1.0-RC3v5.1.1v5.1.2v5.1.2-RC1v5.1.2-RC2v5.1.3v5.1.3-RC1v5.1.4v5.1.5v5.1.6v5.2.0v5.2.0-BETA1v5.2.0-RC1v5.2.0-RC2v5.2.0-RC3v5.2.1v5.2.10v5.2.11v5.2.12v5.2.13v5.2.14v5.2.15v5.2.16v5.2.17v5.2.18v5.2.19v5.2.2v5.2.20v5.2.21v5.2.22v5.2.23v5.2.24v5.2.25v5.2.26v5.2.27v5.2.3v5.2.4v5.2.5v5.2.6	5.7.7

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-21651 is a medium vulnerability (CVSS 6.8) in Shopware, published January 5, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.80%, the 56th percentile. Fixed in shopware/shopware 5.7.7.

References

This page doesn't list everything

Left out here: 49 versions. The JSON record has them.