GitHub Advisoryadvisory · Packagist

GHSA-5vmg-x99g-396q Shopware vulnerable to SSRF

HIGH Published 2022-05-24 Modified 2023-08-22 Official page ↗
Aliases
CVE-2020-13970
Ecosystem
Packagist
Packages
shopware/platform
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-918
Reviewed
2023-07-13

Affected packages

• Packagist shopware/platform: < 6.2.3 → fixed in 6.2.3

Description

Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature. This allows an authenticated user to send HTTP, HTTPS, FTP, and SFTP requests on behalf of the Shopware platform server.

Related

Alias · CVE (1)

  • CVE-2020-13970 Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References