PT-2020-21182 · Shopware · Shopware

Published 2020-10-19 · Updated 2020-10-19

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.3.2.1

Description The issue concerns Authenticated XML External Entity Processing. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For versions prior to 6.3.2.1, update to version 6.3.2.1 using the Auto-Updater or download it directly from the official website. For older versions of 6.1 and 6.2, apply the corresponding changes via the plugin available in the store.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

GHSA-8XV9-QCR9-WW9J

Affected Products

Shopware

References · 4

• https://osv.dev/vulnerability/GHSA-8xv9-qcr9-ww9j · Vendor Advisory
• https://github.com/shopware/platform · Note
• https://github.com/shopware/platform/security/advisories/GHSA-8xv9-qcr9-ww9j · Note
• https://snyk.io/vuln/SNYK-PHP-SHOPWAREPLATFORM-1019470 · Note