PT-2021-21826 · Shopware · Shopware

Shyim · Published 2021-08-16 · Updated 2022-10-25 · CVE-2021-37708

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.4.3.1

Description The issue is related to a command injection vulnerability in mail agent settings. This vulnerability affects Shopware, an open source eCommerce platform. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For versions prior to 6.4.3.1, update to version 6.4.3.1 to resolve the issue. For older versions of 6.1, 6.2, and 6.3, install the corresponding security plugin as a workaround.

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2021-37708

GHSA-XH55-2FQP-P775

Affected Products

Shopware

References · 9

• https://github.com/shopware/platform/commit/82d8d1995f6ce9054323b2c3522b1b3cf04853aa · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-37708 · Security Note
• https://osv.dev/vulnerability/GHSA-xh55-2fqp-p775 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37708 · Vendor Advisory
• https://github.com/shopware/platform/security/advisories/GHSA-xh55-2fqp-p775 · Note
• https://github.com/shopware/platform · Note
• https://t.me/cibsecurity/27413 · Telegram Post
• https://t.me/cvenotify/19493 · Telegram Post
• https://t.me/cvenotify/19475 · Telegram Post