GitHub Advisoryadvisory · Packagist

GHSA-54gp-qff8-946c Insecure direct object reference of log files of the Import/Export feature

MEDIUM Published 2021-08-30 Modified 2021-08-26 Official page ↗
Aliases
CVE-2021-37709
Ecosystem
Packagist
Packages
shopware/platform, shopware/core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532, CWE-639
Reviewed
2021-08-26

Affected packages

• Packagist shopware/platform: < 6.4.3.1 → fixed in 6.4.3.1 • Packagist shopware/core: < 6.4.3.1 → fixed in 6.4.3.1

Description

Impact Insecure direct object reference of log files of the Import/Export feature Patches We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#shopware-6 Workarounds For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

Related

Alias · CVE (1)

  • CVE-2021-37709 Shopware is an open source eCommerce platform. vulnerability

Weakness · CWE (2)

  • CWE-532 Insertion of Sensitive Information into Log File weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References