UpHeron
All vulnerabilities

Servers and applications

CVE-2024-22408

Server-Side Request Forgery (SSRF) in Flow Builder

Severity
High 8.1
Published
16 Jan 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
5.7.4, 6.5.7.4
Also known as
GHSA-3535-m8vh-vrmw
Sources
NVD, Project advisories (GitHub)

Description

Shopware is an open headless commerce platform. The implemented Flow Builder functionality in the Shopware application does not adequately validate the URL used when creating the “call webhook” action. This enables malicious users to perform web requests to internal hosts. This issue has been fixed in the Commercial Plugin release 6.5.7.4 or with the Security Plugin. For installations with…

Affected software

SoftwareAffected versions
ShopwareServers and applications · cpe:a:shopware:shopware
  • Every version before 6.5.7.4
ShopwareServers and applications · github:shopware/shopware
  • Every version before 5.7.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-22408
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-22408
  • GitHub Advisory Database https://github.com/advisories/GHSA-3535-m8vh-vrmw
  • github.com https://github.com/shopware/shopware/security/advisories/GHSA-3535-m8vh-vrmw