PT-2021-23161 · Shopware · Shopware

Published

2021-10-26

·

Updated

2021-10-28

·

CVE-2021-41188

CVSS v3.1

5.7

Medium

VectorAV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions Shopware versions prior to 5.7.6
Description Shopware is open source e-commerce software that contains a cross-site scripting issue. This issue is patched in version 5.7.6. Two workarounds are available to protect against cross-site scripting: using the security plugin or adding a particular config to the .htaccess file for those using Apache, and a config for those using nginx as a server. The plugin and the configs can be found on the GitHub Security Advisory page for this issue.
Recommendations For versions prior to 5.7.6, update to version 5.7.6 to resolve the issue. As a temporary workaround, consider using the security plugin to protect against cross-site scripting. Alternatively, add the following config to your .htaccess file to protect against cross-site scripting:
<IfModule mod headers.c>
  <FilesMatch ".(?i:svg)$">
    Header set Content-Security-Policy "script-src 'none'"
  </FilesMatch>
</IfModule>
For those using nginx as a server, add the following to your configuration:
server {
  # ...
  
  location ~* ^.+.svg$ {
    add header Content-Security-Policy "script-src 'none'";
  }
}

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-41188
GHSA-4P3X-8QW9-24W9

Affected Products

Shopware