GitHub Advisoryadvisory · Packagist

GHSA-6m27-7cqj-2mxw Shopware XXE Vulnerability

MEDIUM Published 2022-05-14 Modified 2023-07-26 Official page ↗
Aliases
CVE-2017-18357
Ecosystem
Packagist
Packages
shopware/shopware
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-610
Reviewed
2023-07-26

Affected packages

• Packagist shopware/shopware: < 5.3.4 → fixed in 5.3.4

Description

Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller, with resultant XXE via instantiation of a SimpleXMLElement object.

Related

Alias · CVE (1)

  • CVE-2017-18357 Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the… vulnerability

Weakness · CWE (1)

  • CWE-610 Externally Controlled Reference to a Resource in Another Sphere weakness

References