Shopware Storefront Reflected XSS in Storefront Login Page
Impact
By exploiting the XSS vulnerabilities, malicious actors can perform harmful actions in the user's web browser in the session context of the affected user. Some examples of this include, but are not limited to: Obtaining user session tokens. Performing administrative actions (when an administrative user is affected). These vulnerabilities pose a high security risk. Since a sensitive cookie is not configured with the HttpOnly attribute and administrator JWTs are stored in sessionStorage, any successful XSS attack could enable the theft of session cookies and administrative tokens.
Description
A request parameter from the URL of the login page is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter. An attacker can create malicious links that could be used in a phishing attack. The parameter waitTime lacks proper input validation.
The attack can be tested with the following URL pattern:
/account/login?loginError=1&waitTime=<a%20href%3D"https%3A%2F%2Fde.wikipedia.org%2Fwiki%2FPhishing">Here<%2Fa>The same applies to the errorSnippet parameter:
/account/login?loginError=1&errorSnippet=Reset%20your%20password%20%3Ca%20href%3D%22https%3A%2F%2Fde.wikipedia.org%2Fwiki%2FPhishing%22%3Ehere%3C%2Fa%3E.Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | shopware/shopware | >= 6.4.6.0, < 6.6.10.10, >= 6.7.0.0, < 6.7.5.1 | 6.6.10.10, 6.7.5.1 |
| Paquete de Composer | shopware/storefront | >= 6.4.6.0, < 6.6.10.10, >= 6.7.0.0, < 6.7.5.1 | 6.6.10.10, 6.7.5.1 |
Referencias
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N- Debilidad (CWE)
CWE-79- Plataforma
- Composer
- Paquete
shopware/shopware, shopware/storefront- Publicada
- 09.12.2025
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-6w82-v552-wjw2 - CC BY 4.0
Historial de vulnerabilidades: shopware/shopware
Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 34
- Primera → última
- 11.2020 01.2026
- Sin corrección
- 3
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 4
- Alta 6
- Media 20
- Baja 4
Divulgaciones por año
- 2020: 3
- 2021: 6
- 2022: 15
- 2023: 3
- 2024: 4
- 2025: 2
- 2026: 1
-
Shopware Storefront Reflected XSS in Storefront Login Page esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.