CVE-2023-22730
Improper Input Validation of Clearance sale in cart
Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions It was possible to put the same line item multiple times in the cart using the AP. The Cart Validators checked the line item's individuality and the user was able to bypass quantity limits in sales. This problem has been fixed with version 6.4.18.1. Users on major versions 6.1, 6.2, and 6.3 may also obtain this fix via a plugin.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper Input Validation of Clearance sale in cart
Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions It was possible to put the same line item multiple times in the cart using the AP. The Cart Validators checked the line item's individuality and the user was able to bypass quantity limits in sales. This problem has been fixed with version 6.4.18.1. Users on major versions 6.1, 6.2, and 6.3 may also obtain this fix via a plugin.
- Record
CVE-2023-22730- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2023-0414
Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions It was possible to put the same line item multiple times in the cart using the AP. The Cart Validators checked the line item's individuality and the user was able to bypass quantity limits in sales. This problem has been fixed with version 6.4.18.1. Users on major versions 6.1, 6.2, and 6.3 may also obtain this fix via a plugin.
- Record
EUVD-2023-0414- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8r6h-m72v-38fg
Shopware vulnerable to Improper Input Validation of Clearance sale in cart
Impact
It is possible to put the same line item multiple one in the cart using API, the Cart Validators checked the line item's individuality and the user was able to skip the clearance sale in cart
Patches
The problem has been fixed with 6.4.18.1
Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. Or disable the newsletter registration completely.
References
- Record
GHSA-8r6h-m72v-38fg- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions It was possible to put the same line item multiple times in the cart using the AP. The Cart Validators checked the line item's individuality and the user was able to bypass quantity limits in sales. This problem has been fixed with version 6.4.18.1. Users on major versions 6.1, 6.2, and 6.3 may also obtain this fix via a plugin.
- Record
CVE-2023-22730- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Improper Input Validation of Clearance sale in cart
Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions It was possible to put the same line item multiple times in the cart using the AP. The Cart Validators checked the line item's individuality and the user was able to bypass quantity limits in sales. This problem has been fixed with version 6.4.18.1. Users on major versions 6.1, 6.2, and 6.3 may also obtain this fix via a plugin.
- Record
CVE-2023-22730- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-8r6h-m72v-38fg
Shopware vulnerable to Improper Input Validation of Clearance sale in cart
Impact
It is possible to put the same line item multiple one in the cart using API, the Cart Validators checked the line item's individuality and the user was able to skip the clearance sale in cart
Patches
The problem has been fixed with 6.4.18.1
Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. Or disable the newsletter registration completely.
References
- Record
GHSA-8r6h-m72v-38fg- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
shopware/platformPackagist |
through 6.4.18.0 | 6.4.18.1 |
shopware/corePackagist |
through 6.4.18.0 | 6.4.18.1 |
shopware/platformPackagist |
before 6.4.18.1, plus listed versions 6.3.0.06.3.0.16.3.0.26.3.1.06.3.1.1 Show 45 moreShow less6.3.2.06.3.2.16.3.3.06.3.3.16.3.4.06.3.4.16.3.5.06.3.5.16.3.5.26.3.5.36.3.5.46.4.0.06.4.0.0-RC16.4.1.06.4.1.16.4.1.26.4.10.06.4.10.16.4.11.06.4.11.16.4.12.06.4.13.06.4.14.06.4.15.06.4.15.16.4.15.26.4.16.06.4.16.16.4.17.06.4.17.16.4.17.26.4.18.06.4.2.06.4.2.16.4.3.06.4.3.16.4.4.06.4.4.16.4.5.06.4.5.16.4.6.06.4.6.16.4.7.06.4.8.06.4.8.1 |
6.4.18.1 |
shopware/corePackagist |
before 6.4.18.1, plus listed versions 6.3.0.06.3.0.16.3.0.26.3.1.06.3.1.1 Show 45 moreShow less6.3.2.06.3.2.16.3.3.06.3.3.16.3.4.06.3.4.16.3.5.06.3.5.16.3.5.26.3.5.36.3.5.46.4.0.06.4.0.0-RC16.4.1.06.4.1.16.4.1.26.4.10.06.4.10.16.4.11.06.4.11.16.4.12.06.4.13.06.4.14.06.4.15.06.4.15.16.4.15.26.4.16.06.4.16.16.4.17.06.4.17.16.4.17.26.4.18.06.4.2.06.4.2.16.4.3.06.4.3.16.4.4.06.4.4.16.4.5.06.4.5.16.4.6.06.4.6.16.4.7.06.4.8.06.4.8.1 |
6.4.18.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-22730 is a medium vulnerability (CVSS 5.3) in Runzero Platform, published January 17, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 52nd percentile. Fixed in shopware/platform 6.4.18.1.
References
github.com/shopware/platform/security/advisories/GHSA-8r6h-m72v-38fg
docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates
nvd.nist.gov/vuln/detail/CVE-2023-22730
Left out here: 38 versions. The JSON record has them.