CVE-2024-42355

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.6.5.1 Shopware versions prior to 6.5.8.13

Description The issue concerns a new Twig Tag sw silent feature call in Shopware, which silences deprecation messages. This tag accepts a string parameter for the feature flag name to silence, but the parameter is not properly escaped, allowing code execution.

Recommendations Update to Shopware 6.6.5.1 to receive a patch. Update to Shopware 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, install a plugin that provides corresponding security measures to mitigate the issue.