{"id":"CVE-2022-31148","aliases":["EUVD-2022-6240","GHSA-5834-xv5q-cgfw"],"status":"published","title":"Persistent cross site scripting in customer module in Shopware","description":"Shopware is an open source e-commerce software. In versions from 5.7.0 a persistent cross site scripting (XSS) vulnerability exists in the customer module. Users are recommend to update to the current version 5.7.14. You can get the update to 5.7.14 regularly via the Auto-Updater or directly via the download overview. There are no known workarounds for this issue.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00693,"percentile":0.53243,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2022-07-27T22:06:09Z","modified":"2026-06-17T04:44:54Z","fixes":[{"ecosystem":"Packagist","package":"shopware/shopware","fixed_in":["5.7.14"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"shopware/shopware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.0"},{"last_affected":"5.7.13"},{"fixed":"5.7.14"}]}]},{"source":"osv","ecosystem":"Packagist","package":"shopware/shopware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.0"},{"fixed":"5.7.14"}]}],"versions":["v5.7.0","v5.7.1","v5.7.10","v5.7.11","v5.7.12","v5.7.13","v5.7.2","v5.7.3","v5.7.4","v5.7.5","v5.7.6","v5.7.7","v5.7.8","v5.7.9"]}],"products":[{"vendor":"shopware","product":"shopware"}],"references":[{"url":"https://github.com/shopware/shopware/security/advisories/GHSA-5834-xv5q-cgfw","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"https://github.com/shopware/shopware/commit/7875855005648fba7b39371a70816afae2e07daf","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-07-2022","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","web"]},{"url":"https://www.shopware.com/en/changelog-sw5/#5-7-14","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31148","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5834-xv5q-cgfw"},{"url":"https://github.com/shopware/shopware","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-31148","title":"Persistent cross site scripting in customer module in Shopware","description":"Shopware is an open source e-commerce software. In versions from 5.7.0 a persistent cross site scripting (XSS) vulnerability exists in the customer module. Users are recommend to update to the current version 5.7.14. You can get the update to 5.7.14 regularly via the Auto-Updater or directly via the download overview. There are no known workarounds for this issue.","status":"published","published":"2022-08-01T17:10:12Z","modified":"2025-04-23T17:56:53.899Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:35.615708Z"}],"euvd":[{"id":"EUVD-2022-6240","description":"Shopware is an open source e-commerce software. In versions from 5.7.0 a persistent cross site scripting (XSS) vulnerability exists in the customer module. Users are recommend to update to the current version 5.7.14. You can get the update to 5.7.14 regularly via the Auto-Updater or directly via the download overview. There are no known workarounds for this issue.","status":"published","published":"2022-08-01T17:10:12Z","modified":"2025-04-23T17:56:53Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:09.919052Z"}],"ghsa":[{"id":"GHSA-5834-xv5q-cgfw","title":"Shopware vulnerable to persistent cross site scripting (XSS) in customer module","description":"### Impact\nPersistent XSS in customer module\n\n### Patches\n\nWe recommend updating to the current version 5.7.14. You can get the update to 5.7.14 regularly via the Auto-Updater or directly via the download overview.\n\nFor older versions you can use the Security Plugin:\nhttps://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html\n\n### References\nhttps://docs.shopware.com/en/shopware-5-en/security-updates/security-update-07-2022","status":"published","published":"2022-07-27T22:06:09Z","modified":"2023-01-31T05:01:39Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:29.100018Z"}],"nvd":[{"id":"CVE-2022-31148","description":"Shopware is an open source e-commerce software. In versions from 5.7.0 a persistent cross site scripting (XSS) vulnerability exists in the customer module. Users are recommend to update to the current version 5.7.14. You can get the update to 5.7.14 regularly via the Auto-Updater or directly via the download overview. There are no known workarounds for this issue.","status":"published","published":"2022-08-01T17:15:08.467Z","modified":"2026-06-17T04:44:54.277Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:24.39467Z"}],"osv":[{"id":"GHSA-5834-xv5q-cgfw","title":"Shopware vulnerable to persistent cross site scripting (XSS) in customer module","description":"### Impact\nPersistent XSS in customer module\n\n### Patches\n\nWe recommend updating to the current version 5.7.14. You can get the update to 5.7.14 regularly via the Auto-Updater or directly via the download overview.\n\nFor older versions you can use the Security Plugin:\nhttps://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html\n\n### References\nhttps://docs.shopware.com/en/shopware-5-en/security-updates/security-update-07-2022","status":"published","published":"2022-07-27T22:06:09Z","modified":"2023-11-08T04:09:27.666191Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:38.213481Z"}]}}