GitHub Advisoryadvisory · Packagist

GHSA-cgfj-hj93-rmh2 Shopware allows Denial Of Service via password length

HIGH Published 2025-04-08 Modified 2025-04-08 Official page ↗
Aliases
CVE-2025-30151
Ecosystem
Packagist
Packages
shopware/core, shopware/platform
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-20
Reviewed
2025-04-08

Affected packages

• Packagist shopware/core: >= 6.6.0.0, < 6.6.10.3 → fixed in 6.6.10.3 • Packagist shopware/platform: >= 6.6.0.0, < 6.6.10.3 → fixed in 6.6.10.3 • Packagist shopware/core: >= 6.7.0.0-rc1, < 6.7.0.0-rc2 → fixed in 6.7.0.0-rc2 • Packagist shopware/platform: >= 6.7.0.0-rc1, < 6.7.0.0-rc2 → fixed in 6.7.0.0-rc2 • Packagist shopware/core: < 6.5.8.17 → fixed in 6.5.8.17 • Packagist shopware/platform: < 6.5.8.17 → fixed in 6.5.8.17

Description

Impact It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. Patches Update to Shopware 6.6.10.3 or 6.5.8.17 Workarounds For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References