从这个网页截图中，可以获取到以下关于漏洞的关键信息： 1. 漏洞描述： - 漏洞名称：Improper Access Control with ManyToMany associations in store-api - 漏洞等级：Moderate (5.3/10) - 漏洞影响：The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON. - 漏洞原因：The processing of the Criteria did not considered ManyToMany associations and so they were not considered properly and the protections didn't get used. 2. 受影响的版本： - shopware/core (Composer)： - = 6.6.0.0 = 6.6.0.0 <= 6.6.5.0 3. 修复措施： - 更新到 Shopware 6.6.5.1 或 6.5.8.13 4. 工作绕过： - 对于旧版本的 6.2、6.3 和 6.4，可以通过插件获取相应的安全措施。建议更新到最新的 Shopware 版本以获取完整的功能。 5. 漏洞编号： - CVE-2024-42354 6. 漏洞分类： - CWE-284 7. 报告者： - JoshuaBehrens