GitHub Advisoryadvisory · Packagist

GHSA-6wrh-279j-6hvw HTTP caching is marking private HTTP headers as public in Shopware

MEDIUM Published 2022-03-10 Modified 2022-03-18 Official page ↗
Aliases
CVE-2022-24747
Ecosystem
Packagist
Packages
shopware/platform, shopware/core, shopware/storefront
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-668
Reviewed
2022-03-10

Affected packages

• Packagist shopware/platform: < 6.4.8.2 → fixed in 6.4.8.2 • Packagist shopware/core: < 6.4.8.2 → fixed in 6.4.8.2 • Packagist shopware/storefront: < 6.4.8.2 → fixed in 6.4.8.2

Description

Impact HTTP caching is marking private HTTP headers as public Patches Fixed in recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#shopware-6 Workarounds For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Related

Alias · CVE (1)

  • CVE-2022-24747 Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References