PT-2021-21825 · Shopware · Shopware

Moderateshyim · Published 2021-08-16 · Updated 2021-08-30 · CVE-2021-37707

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.4.3.1

Description The issue allows manipulation of product reviews via API.

Recommendations For versions prior to 6.4.3.1, update to version 6.4.3.1. For older versions of 6.1, 6.2, and 6.3, apply corresponding security measures available via a plugin.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2021-37707

GHSA-9F8F-574Q-8JMF

Affected Products

Shopware

References · 8

• https://github.com/shopware/platform/commit/912b96de3b839c6c5525c98cbb58f537c2d838be · Patch
• https://osv.dev/vulnerability/CVE-2021-37707 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37707 · Security Note
• https://osv.dev/vulnerability/GHSA-9f8f-574q-8jmf · Vendor Advisory
• https://github.com/shopware/platform/security/advisories/GHSA-9f8f-574q-8jmf · Note
• https://github.com/shopware/platform · Note
• https://t.me/cvenotify/19489 · Telegram Post
• https://t.me/cibsecurity/27404 · Telegram Post