CVE-2017-15374
Estado: ModificadaMedia (6.1)—💥 Exploit
Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to provoke persistent execution in the customer and orders section of the backend. The execution occurs in the administrator backend listing when processing a preview of the customers (kunden) or orders (bestellungen). The injection can be performed interactively via user registration or by manipulation of the order information inputs. The issue can be exploited by low privileged user accounts against higher privileged (admin or moderator) accounts.
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Puntuación base: 6.1
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 4.81%
- Percentil entre todas las CVEs puntuadas: 92
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
💥 Exploits públicos
Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.
- Publicado en Exploit-DB · Shopware 5.2.5/5.3 - Cross-Site Scripting (21/1/2018)
Tecnologías afectadas (1)
CWE
- CWE-79
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2017-15374",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "CHANGED",
"version": "3.0",
"baseScore": 6.1,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 2.7,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2017-10-16T04:29:00.360",
"references": [
{
"url": "https://www.exploit-db.com/exploits/43849/",
"source": "cve@mitre.org"
},
{
"url": "https://www.vulnerability-lab.com/get_content.php?id=1922",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://www.exploit-db.com/exploits/43849/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.vulnerability-lab.com/get_content.php?id=1922",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to provoke persistent execution in the customer and orders section of the backend. The execution occurs in the administrator backend listing when processing a preview of the customers (kunden) or orders (bestellungen). The injection can be performed interactively via user registration or by manipulation of the order information inputs. The issue can be exploited by low privileged user accounts against higher privileged (admin or moderator) accounts."
},
{
"lang": "es",
"value": "Shopware v5.2.5 - v5.3 es vulnerable a Cross-Site Scripting (XSS) en la sección \"customer and order\", en los módulos del backend del sistema de gestión de contenidos. Los atacantes remotos pueden inyectar código script malicioso en los campos de entrada \"firstname\", \"lastname\" u \"order\" para provocar ejecución persistente en el backend de la sección \"customer and orders\". La ejecución tiene lugar en el listado del backend del administrador cuando se procesa una previsualización de los clientes (kunden) o pedidos (bestellungen). La inyección se puede llevar a cabo de manera interactiva mediante el registro de un usuario o la manipulación de la información de entrada del pedido. Este problema puede explotarse mediante cuentas de usuario con bajo nivel de privilegios contra cuentas de usuario con un alto nivel de privilegios (admin o moderador)."
}
],
"lastModified": "2026-06-17T01:07:43.190",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:shopware:shopware:5.2.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A98C81BA-C02A-4922-A2C9-5F9B0C44F66A"
},
{
"criteria": "cpe:2.3:a:shopware:shopware:5.2.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B71AF028-D8FB-4EE5-8837-902266746B30"
},
{
"criteria": "cpe:2.3:a:shopware:shopware:5.2.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "39A52730-1F2E-4E7C-9DD6-779359B940B6"
},
{
"criteria": "cpe:2.3:a:shopware:shopware:5.2.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ACE43F26-A702-475D-93D5-EF1E31F4A696"
},
{
"criteria": "cpe:2.3:a:shopware:shopware:5.2.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F578B155-0829-4893-896C-63AC246B93FE"
},
{
"criteria": "cpe:2.3:a:shopware:shopware:5.2.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "05329E79-7E98-4292-8302-107A7272245B"
},
{
"criteria": "cpe:2.3:a:shopware:shopware:5.2.11:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F4A6127A-6CE8-413A-959B-FAB967E9E128"
},
{
"criteria": "cpe:2.3:a:shopware:shopware:5.2.12:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "487BB1D2-BE19-4898-974D-310FF3E6A70E"
},
{
"criteria": "cpe:2.3:a:shopware:shopware:5.2.13:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "55B7F4A3-AA6A-4D07-A53F-D94D47741F71"
},
{
"criteria": "cpe:2.3:a:shopware:shopware:5.2.14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "19BE6A0C-EAA5-46BC-A1F2-FB009C43EA7C"
},
{
"criteria": "cpe:2.3:a:shopware:shopware:5.2.15:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "71F3354D-3474-469C-9F76-C47F5D110333"
},
{
"criteria": "cpe:2.3:a:shopware:shopware:5.2.16:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "31796263-22D2-414E-9FC5-581A1578DDC6"
},
{
"criteria": "cpe:2.3:a:shopware:shopware:5.2.17:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ED1117F7-3895-4FFC-9CE4-438F4FF82026"
},
{
"criteria": "cpe:2.3:a:shopware:shopware:5.2.18:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "21704EBC-F4ED-4498-9BC4-1CA5F0D71FCE"
},
{
"criteria": "cpe:2.3:a:shopware:shopware:5.2.19:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "51AD4596-25BF-497F-BEAD-6F1D0DB685C3"
},
{
"criteria": "cpe:2.3:a:shopware:shopware:5.2.20:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C554CFEF-E2D0-407D-8188-4AC462C577AF"
},
{
"criteria": "cpe:2.3:a:shopware:shopware:5.2.21:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A0BC3DA7-E018-4730-813A-73CD87763DCE"
},
{
"criteria": "cpe:2.3:a:shopware:shopware:5.2.22:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "87015926-3E86-49FD-B2FE-D08AE7388FC3"
},
{
"criteria": "cpe:2.3:a:shopware:shopware:5.2.23:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E8B57EFF-119A-4B44-B9DD-127A2C71A542"
},
{
"criteria": "cpe:2.3:a:shopware:shopware:5.2.24:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2E707EAF-ECC4-4DC7-A14B-EE29DFE2DF79"
},
{
"criteria": "cpe:2.3:a:shopware:shopware:5.2.25:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B77D2421-CBAF-4352-8043-6E90C3D9309E"
},
{
"criteria": "cpe:2.3:a:shopware:shopware:5.2.26:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "149CD512-F467-4D7E-AFB0-FAFBC9EE5C03"
},
{
"criteria": "cpe:2.3:a:shopware:shopware:5.2.27:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A11008C2-B39D-43AA-AC60-A2626255AE5F"
},
{
"criteria": "cpe:2.3:a:shopware:shopware:5.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1A9C290F-3849-414C-BF6E-4FB0CCC8B1B5"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}