Skip to content

Authenticated Server Side Request Forgery

Low severity GitHub Reviewed Published Dec 15, 2020 in shopware/shopware • Updated Jan 9, 2023

Package

composer shopware/core (Composer)

Affected versions

<= 6.3.4.0

Patched versions

6.3.4.1
composer shopware/platform (Composer)
<= 6.3.4.0
6.3.4.1

Description

Impact

Authenticated Server Side Request Forgery

Patches

We recommend to update to the current version 6.3.4.1. You can get the update to 6.3.4.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

Workarounds

For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

For more information

https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-12-2020

Credits

We would like to thank REQON B.V. for reporting this issue.

References

@pweyck pweyck published to shopware/shopware Dec 15, 2020
Reviewed Dec 21, 2020
Published to the GitHub Advisory Database Dec 21, 2020
Last updated Jan 9, 2023

Severity

Low

Weaknesses

CVE ID

No known CVE

GHSA ID

GHSA-8pfh-mm2g-hmc3

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.