{"id":"CVE-2019-12799","aliases":["EUVD-2022-5158","GHSA-rf8f-hqjv-986p"],"status":"published","title":"Shopware Insecure Deserialization Vulnerability","description":"In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code execution. NOTE: this issue is a bypass for a CVE-2017-18357 whitelist patch.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:U/UI:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.54055,"percentile":0.99012,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-502"],"published":"2019-06-13T19:18:41Z","modified":"2026-06-17T02:15:30Z","exploits":[{"source":"metasploit","id":"exploit/multi/http/shopware_createinstancefromnamedarguments_rce","title":"Shopware createInstanceFromNamedArguments PHP Object Instantiation RCE","type":"exploit","platform":"PHP","date":"2019-05-09","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/shopware_createinstancefromnamedarguments_rce"}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"shopware/shopware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0"},{"last_affected":"5.6.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"shopware/shopware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0"},{"last_affected":"5.6.0"}]}],"versions":["5.3.0","v5.3.4","v5.3.5","v5.3.6","v5.3.7","v5.4.0","v5.4.0-RC1","v5.4.1","v5.4.2","v5.4.3","v5.4.4","v5.4.5","v5.4.6","v5.5.0","v5.5.0-BETA1","v5.5.0-RC1","v5.5.1","v5.5.10","v5.5.2","v5.5.3","v5.5.4","v5.5.5","v5.5.6","v5.5.7","v5.5.8","v5.5.9","v5.6.0","v5.6.0-RC1"]}],"products":[{"vendor":"shopware","product":"shopware"}],"references":[{"url":"https://github.com/rapid7/metasploit-framework/pull/11828","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12799","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6m27-7cqj-2mxw","tags":["advisory"]},{"url":"https://web.archive.org/web/20171112153855/https://blog.ripstech.com/2017/shopware-php-object-instantiation-to-blind-xxe/"},{"url":"https://github.com/advisories/GHSA-rf8f-hqjv-986p"},{"url":"https://github.com/shopware5/shopware","tags":["package"]},{"url":"https://web.archive.org/web/20171112153855/https://blog.ripstech.com/2017/shopware-php-object-instantiation-to-blind-xxe","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-12799","description":"In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code execution. NOTE: this issue is a bypass for a CVE-2017-18357 whitelist patch.","status":"published","published":"2019-06-13T19:18:41Z","modified":"2024-08-04T23:32:55.188Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:U/UI:N","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:20:23.697579Z"}],"euvd":[{"id":"EUVD-2022-5158","description":"In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code execution. NOTE: this issue is a bypass for a CVE-2017-18357 whitelist patch.","status":"published","published":"2019-06-13T19:18:41Z","modified":"2024-08-04T23:32:55Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:U/UI:N","level":"medium"}],"updated_at":"2026-11-03T02:40:44.337354Z"}],"ghsa":[{"id":"GHSA-rf8f-hqjv-986p","title":"Shopware Insecure Deserialization Vulnerability","description":"In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code execution. NOTE: this issue is a bypass for a CVE-2017-18357 whitelist patch.","status":"published","published":"2022-05-24T16:48:00Z","modified":"2023-07-31T20:21:39Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:36:58.760727Z"}],"nvd":[{"id":"CVE-2019-12799","description":"In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code execution. NOTE: this issue is a bypass for a CVE-2017-18357 whitelist patch.","status":"published","published":"2019-06-13T20:29:00.173Z","modified":"2026-06-17T02:15:30.097Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:05:16.285679Z"}],"osv":[{"id":"GHSA-rf8f-hqjv-986p","title":"Shopware Insecure Deserialization Vulnerability","description":"In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code execution. NOTE: this issue is a bypass for a CVE-2017-18357 whitelist patch.","status":"published","published":"2022-05-24T16:48:00Z","modified":"2024-02-16T08:16:39.454275Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:55.877614Z"}]}}