PT-2021-24375 · Shopware · Shopware
Published
2021-04-13
·
Updated
2021-04-13
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions:
Shopware versions prior to 6.3.5.3
Description:
The issue allows sensitive files, such as .env, to be leaked if the project root is configured as the web root instead of
/public. This can lead to exposure of sensitive information. It is recommended to always use /public as the web root to prevent such leaks.Recommendations:
For versions prior to 6.3.5.3, update to version 6.3.5.3 to resolve the issue. As a temporary workaround, consider configuring the web root to
/public to minimize the risk of exploitation. For older versions of 6.1 and 6.2, a security plugin is available, but updating to the latest Shopware version is recommended for the full range of functions.Files Accessible to External Parties
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Shopware