{"cve":"CVE-2024-42354","nvd":{"published":"2024-08-08T15:15:17.793","modified":"2026-06-17T07:49:18.903","status":"Analyzed","description":"Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON. Prior to versions 6.6.5.1 and 6.5.8.13, the processing of the Criteria did not considered ManyToMany associations and so they were not considered properly and the protections didn't get used. This issue cannot be reproduced with the default entities by Shopware, but can be triggered with extensions. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3,  and 6.4, corresponding security measures are also available via a plugin.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","score":5.9},"cwes":["CWE-284"],"references":["https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f","https://github.com/shopware/core/commit/d35ee2eda5c995faeb08b3dad127eab65c64e2a2","https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac","https://github.com/shopware/shopware/commit/ad83d38809df457efef21c37ce0996430334bf01","https://github.com/shopware/shopware/security/advisories/GHSA-hhcq-ph6w-494g"],"products":["shopware:shopware"],"source":"nvd","synced_at":"2026-10-19T21:53:51.317825789+00:00"},"epss":{"cve":"CVE-2024-42354","score":0.00429,"percentile":0.37134,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}