GitHub Advisoryadvisory · Packagist

GHSA-r4ph-mx67-x58p Shopware database password is leaked to an unauthenticated users

HIGH Published 2022-05-24 Modified 2024-07-08 Official page ↗
Aliases
CVE-2020-13997
Ecosystem
Packagist
Packages
shopware/core, shopware/platform
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-209
Reviewed
2024-04-24

Affected packages

• Packagist shopware/core: >= 6.0.0, < 6.2.3 → fixed in 6.2.3 • Packagist shopware/platform: >= 6.0.0, < 6.2.3 → fixed in 6.2.3

Description

In Shopware 6 before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled. This vulnerability does not affect the shopware 5 release branch (`shopware/shopware` on packagist).

Related

Alias · CVE (1)

  • CVE-2020-13997 In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error… vulnerability

Weakness · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References