PT-2021-21827 · Shopware · Shopware

Shyim · Published 2021-08-16 · Updated 2022-04-25 · CVE-2021-37709

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.4.3.1

Description The issue involves an insecure direct object reference of log files of the Import/Export feature. This allows unauthorized access to sensitive information. A patch for this issue is available in version 6.4.3.1. For older versions of 6.1, 6.2, and 6.3, security measures are available via a plugin.

Recommendations For versions prior to 6.4.3.1, update to version 6.4.3.1 to resolve the issue. For older versions of 6.1, 6.2, and 6.3, install the available security plugin as a workaround. As a temporary measure, consider restricting access to the Import/Export feature until the update or plugin installation is complete.

Fix

Insertion into Log File

IDOR

Weakness Enumeration

CWE-532

CWE-639

Related Identifiers

CVE-2021-37709

GHSA-54GP-QFF8-946C

Affected Products

Shopware

References · 7

• https://github.com/shopware/platform/commit/a9f52abb6eb503654c492b6b2076f8d924831fec · Patch
• https://osv.dev/vulnerability/CVE-2021-37709 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37709 · Security Note
• https://osv.dev/vulnerability/GHSA-54gp-qff8-946c · Vendor Advisory
• https://github.com/shopware/platform/security/advisories/GHSA-54gp-qff8-946c · Note
• https://github.com/shopware/platform · Note
• https://t.me/cvenotify/19499 · Telegram Post