CVE-2022-31148

Persistent cross site scripting in customer module in Shopware

5.4 MediumFix available

Shopware is an open source e-commerce software. In versions from 5.7.0 a persistent cross site scripting (XSS) vulnerability exists in the customer module. Users are recommend to update to the current version 5.7.14. You can get the update to 5.7.14 regularly via the Auto-Updater or directly via the download overview. There are no known workarounds for this issue.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.69%Down 0.2 points since Aug 2, 2022

What each source reports

CVE List Score used 5.4

Persistent cross site scripting in customer module in Shopware

Record: CVE-2022-31148
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2022-6240 5.4

Record: EUVD-2022-6240
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-5834-xv5q-cgfw 5.4

Shopware vulnerable to persistent cross site scripting (XSS) in customer module

Impact

Persistent XSS in customer module

Patches

We recommend updating to the current version 5.7.14. You can get the update to 5.7.14 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

References

https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-07-2022

Record: GHSA-5834-xv5q-cgfw
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

NVD 5.4

Record: CVE-2022-31148
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-5834-xv5q-cgfw 5.4

Shopware vulnerable to persistent cross site scripting (XSS) in customer module

Impact

Persistent XSS in customer module

Patches

We recommend updating to the current version 5.7.14. You can get the update to 5.7.14 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

References

https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-07-2022

Record: GHSA-5834-xv5q-cgfw
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

shopware

Affected packages

Affected packages
Package	Affected	Fixed
`shopware/shopware` Packagist	5.7.0 to 5.7.13	5.7.14
`shopware/shopware` Packagist	5.7.0 up to 5.7.14, plus listed versions v5.7.0v5.7.1v5.7.10v5.7.11v5.7.12 Show 9 moreShow less v5.7.13v5.7.2v5.7.3v5.7.4v5.7.5v5.7.6v5.7.7v5.7.8v5.7.9	5.7.14

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-31148 is a medium vulnerability (CVSS 5.4) in Shopware, published July 27, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 53rd percentile. Fixed in shopware/shopware 5.7.14.