GitHub Advisoryadvisory · Packagist
GHSA-c53v-qmrx-93hg Open redirect in shopware
MEDIUM
Official page ↗
- Aliases
- CVE-2022-21651
- Ecosystem
- Packagist
- Packages
- shopware/shopware
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
- Weaknesses
- CWE-601
- Reviewed
- 2022-01-06
Affected packages
• Packagist shopware/shopware: >= 5.0.0, < 5.7.7 → fixed in 5.7.7
Description
Impact
Arbitrary redirect while using certain URLs
Patches
We recommend updating to the current version 5.7.7. You can get the update to 5.7.7 regularly via the Auto-Updater or directly via the download overview.
For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html
References
https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022
Related
Alias · CVE (1)
- CVE-2022-21651 Shopware is an open source e-commerce software platform. vulnerability
Weakness · CWE (1)
- CWE-601 URL Redirection to Untrusted Site weakness
References
- https://github.com/shopware/shopware/security/advisories/GHSA-c53v-qmrx-93hg web
- https://nvd.nist.gov/vuln/detail/CVE-2022-21651 advisory
- https://github.com/shopware/shopware/commit/a90046c765c57a46c4399dce17bd174253c32886 web
- https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022 web
- https://github.com/shopware/shopware package