GitHub Advisoryadvisory · Packagist

GHSA-fxf3-wx3c-76pf Shopware vulnerable to Cross-site Scripting

MEDIUM Published 2022-05-24 Modified 2023-07-20 Official page ↗
Aliases
CVE-2020-13971
Ecosystem
Packagist
Packages
shopware/platform
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-07-20

Affected packages

• Packagist shopware/platform: < 6.2.3 → fixed in 6.2.3

Description

In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication.

Related

Alias · CVE (1)

  • CVE-2020-13971 In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References