Security readout for executives and security teams
Plain-English summary
Shopware 5 sites before 5.7.12 have an authenticated stored cross-site scripting issue in the Administration area. A logged-in user could store script content that later affects another user who views it. The vendor advises upgrading; no workaround is identified in the source bundle.
Executive priority
Prioritize patching for any production Shopware 5 storefront that is below 5.7.12. This is not marked as actively exploited, but admin compromise in e-commerce systems can affect customer trust, operations, and data integrity.
Technical view
CVE-2022-31057 is CWE-79 stored XSS affecting Shopware 5 versions below 5.7.12. The CVSS 3.1 score is 6.5 with network attack vector, low privileges required, user interaction required, and changed scope with low confidentiality, integrity, and availability impact.
Likely exposure
Exposure is limited to organizations running Shopware 5 earlier than 5.7.12, particularly where Administration access is available to multiple authenticated users. The source bundle does not identify Shopware 6 or other products as affected.
Exploitation context
The source bundle and KEV status do not support a claim of known active exploitation. The issue requires authenticated access and another user interaction, reducing broad internet-scale risk but still relevant for admin-panel trust boundaries.
Researcher notes
Evidence is clear on affected version range, weakness class, CVSS, and vendor upgrade guidance. Public sources in the bundle do not provide exploit details, exploitation telemetry, or a workaround. Avoid expanding affected scope beyond Shopware 5 before 5.7.12.
Mitigation direction
- Upgrade Shopware 5 to version 5.7.12 or later.
- Review the Shopware June 2022 security update and GitHub advisory.
- Do not rely on a workaround; the advisory states none are known.
- Restrict Administration access to trusted users until upgrading is complete.
Validation and detection
- Inventory Shopware deployments and identify versions below 5.7.12.
- Confirm the June 2022 security update or later release is installed.
- Review Administration user access for unnecessary or shared accounts.
- Check vendor advisory status before closing remediation records.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-31057 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L2.33.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/shopware/shopware/security/advisories/GHSA-q754-vwc4-p6qjCVE reference · x_refsource_CONFIRM
- https://github.com/shopware/shopware/commit/3e025a0a3e123f4108082645b1ced6fb548f7b6fCVE reference · x_refsource_MISC
- https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2022CVE reference · x_refsource_MISC
- https://packagist.org/packages/shopware/shopwareCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.