Skip to content

Canceling of orders not related to the logged-in user

Moderate severity GitHub Reviewed Published Jun 24, 2021 in shopware/shopware • Updated Jan 9, 2023

Package

composer shopware/core (Composer)

Affected versions

<= 6.4.1.0

Patched versions

6.4.1.1
composer shopware/platform (Composer)
<= 6.4.1.0
6.4.1.1

Description

Impact

Canceling of orders not related to the logged-in user

Patches

We recommend updating to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

Workarounds

For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

References

@shyim shyim published to shopware/shopware Jun 24, 2021
Reviewed Jun 24, 2021
Published to the GitHub Advisory Database Jun 28, 2021
Last updated Jan 9, 2023

Severity

Moderate

Weaknesses

No CWEs

CVE ID

No known CVE

GHSA ID

GHSA-wq3r-jwrq-xg6w

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.