GitHub Advisoryadvisory · Packagist

GHSA-7gm7-8q8v-9gf2 Server-Side Request Forgery (SSRF) in Shopware

HIGH Published 2022-04-22 Modified 2022-04-22 Official page ↗
Aliases
CVE-2022-24871
Ecosystem
Packagist
Packages
shopware/platform, shopware/core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-918
Reviewed
2022-04-22

Affected packages

• Packagist shopware/platform: < 6.4.10.1 → fixed in 6.4.10.1 • Packagist shopware/core: < 6.4.10.1 → fixed in 6.4.10.1

Description

Impact The attacker can abuse the Admin SDK functionality on the server to read or update internal resources. Patches We recommend updating to the current version 6.4.10.1. You can get the update to 6.4.10.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#shopware-6 Workarounds For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Related

Alias · CVE (1)

  • CVE-2022-24871 Shopware is an open commerce platform based on Symfony Framework and Vue. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References