PT-2017-8339 · Shopware · Shopware

Publicado 2017-04-21 · Atualizado 2022-05-14 · CVE-2016-3109

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 5.1.5

Description The issue allows remote attackers to execute arbitrary code via the "backend/Login/load/" script.

Recommendations For versions prior to 5.1.5, update to version 5.1.5 or later to resolve the issue.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-3109

GHSA-CJ2F-96JQ-PHPP

Produtos afetados

Shopware

Referências · 11

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/shopware/shopware/CVE-2016-3109.yaml · Exploit
• 🔥 http://packetstormsecurity.com/files/136781/Shopware-Remote-Code-Execution.html · Exploit
• https://github.com/shopware/shopware/commit/d73e9031a5b2ab6e918eb86d1e2b2e873cd3558d · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2016-3109 · Nota de Segurança
• https://web.archive.org/web/20200814090044/http://securityfocus.com/archive/1/538173/100/0/threaded · Nota
• http://securityfocus.com/bid/97979 · Nota
• http://securityfocus.com/archive/1/538173/100/0/threaded · Nota
• https://osv.dev/vulnerability/CVE-2016-3109 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-cj2f-96jq-phpp · Aviso do Fabricante
• https://community.shopware.com/_detail_1918.html · Nota
• https://web.archive.org/web/20210125193827/http://securityfocus.com/bid/97979 · Nota