HTML injection possibility in voucher code form in Shopware
Date: 2022-03
Affected: composer/shopware/storefront, composer/shopware/core, composer/shopware/platform
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2022-24746
CWE: CWE-79
CVSS: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

### Impact HTML injection possibility in voucher code form ## Patches Patched in 6.4.8.1, maintainers recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#shopware-6 ## Workarounds For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.


Mitigations:

Architectural layers (MAESTRO):