PT-2021-19881 · Amazon · Amazon Aws

Highshyim · Published 2021-06-24 · Updated 2022-10-25 · CVE-2021-32717

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.4.1.1

Description The issue concerns private files being publicly accessible with Cloud Storage providers when the hashed URL is known. Users are recommended to change their configuration to set the correct visibility according to the documentation, ensuring the visibility is at the same level as type. For Storage saved on Amazon AWS, disabling public access to the bucket containing the private files is advised.

Recommendations To resolve the issue, update to Shopware 6.4.1.1 or install or update the Security plugin and run the command ./bin/console s3:set-visibility to correct cloud file visibilities. As a temporary workaround, consider changing the configuration to set the correct visibility according to the documentation. When the Storage is saved on Amazon AWS, disable public access to the bucket containing the private files.

Fix

Information Disclosure

Incorrect Permission

Weakness Enumeration

CWE-200

CWE-732

Related Identifiers

CVE-2021-32717

GHSA-6GR8-C3M5-MVRG

GHSA-VRF2-XGHR-J52V

Affected Products

Amazon Aws

References · 9

• https://github.com/shopware/platform/commit/ba52f683372b8417a00e9014f481ed3d539f34b3 · Patch
• https://osv.dev/vulnerability/CVE-2021-32717 · Vendor Advisory
• https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-06-2021 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32717 · Security Note
• https://osv.dev/vulnerability/GHSA-6gr8-c3m5-mvrg · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vrf2-xghr-j52v · Vendor Advisory
• https://github.com/shopware/platform/security/advisories/GHSA-vrf2-xghr-j52v · Note
• https://github.com/shopware/platform · Note
• https://t.me/cvenotify/16972 · Telegram Post