GitHub Advisoryadvisory · Packagist
GHSA-vrf2-xghr-j52v Private files publicly accessible with Cloud Storage providers
HIGH
Official page ↗
- Ecosystem
- Packagist
- Packages
- shopware/platform, shopware/core
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-200
- Reviewed
- 2021-06-24
Affected packages
• Packagist shopware/platform: < 6.4.1.1 → fixed in 6.4.1.1
• Packagist shopware/core: < 6.4.1.1 → fixed in 6.4.1.1
Description
Impact
Private files publicly accessible with Cloud Storage providers when the hashed URL is known
Patches
We recommend first changing your configuration to set the correct visibility according to the documentation. The visibility must be at the same level as `type`.
When the Storage is saved on Amazon AWS we recommending disabling public access to the bucket containing the private files: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html
Otherwise, update to Shopware 6.4.1.1 or install or update the Security plugin (https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659) and run the command `./bin/console s3:set-visibility` to correct your cloud file visibilities
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness