Shopware prior 6.5.8.17/6.6.10.3/6.7.0.0-rc2 Newsletter improper control of interaction frequency

Summaryinfo

A vulnerability was found in Shopware. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Newsletter Handler. The manipulation results in improper control of interaction frequency. This vulnerability was named CVE-2025-32378. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Shopware. Affected is some unknown processing of the component Newsletter Handler. The manipulation with an unknown input leads to a improper control of interaction frequency vulnerability. CWE is classifying the issue as CWE-799. The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests. This is going to have an impact on integrity. CVE summarizes:

Shopware is an open source e-commerce software platform. Prior to 6.6.10.3 or 6.5.8.17, the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation. Default settings are Newsletter: Double Opt-in set to active, Newsletter: Double opt-in for registered customers set to disabled, and Log-in & sign-up: Double opt-in on sign-up set to disabled. With these settings, anyone can register an account on the shop using any e-mail-address and then check the check-box in the account page to sign up for the newsletter. The recipient will receive two mails confirming registering and signing up for the newsletter, no confirmation link needed to be clicked for either. In the backend the recipient is set to “instantly active”. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2025-32378 since 04/06/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available.

Upgrading to version 6.5.8.17, 6.6.10.3 or 6.7.0.0-rc2 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Shopware

License

• commercial

Website

• Product: https://github.com/shopware/shopware/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion