Skip to content

Authenticated remote code execution

Moderate severity GitHub Reviewed Published Mar 8, 2021 in shopware/shopware • Updated Jan 9, 2023

Package

composer shopware/platform (Composer)

Affected versions

<= 6.3.5.1

Patched versions

6.3.5.2

Description

Impact

Authenticated remote code execution using plugin manager without ACL permissions.

Patches

We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

Workarounds

For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

For more information

https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-03-2021

References

@Phil23 Phil23 published to shopware/shopware Mar 8, 2021
Reviewed Mar 12, 2021
Published to the GitHub Advisory Database Mar 12, 2021
Last updated Jan 9, 2023

Severity

Moderate

Weaknesses

CVE ID

No known CVE

GHSA ID

GHSA-pjj4-jjgc-h3r8

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.