CVEvulnerability
CVE-2020-13970
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-07-28
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-918
Description
Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature. This allows an authenticated user to send HTTP, HTTPS, FTP, and SFTP requests on behalf of the Shopware platform server.
Affected configurations
• shopware shopware (< 6.2.3)
Related
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness
References
- https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-07-2020 Vendor Advisory
- https://www.shopware.com/en/changelog/#6-2-3 Release Notes, Vendor Advisory
- https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-07-2020 Vendor Advisory
- https://www.shopware.com/en/changelog/#6-2-3 Release Notes, Vendor Advisory