Vulnerability · Published Apr 20, 2022 · Assigned by GitHub_M
CVE-2022-24871Server-Side Request Forgery (SSRF) in Shopware
High 7.2
In plain English
A high-severity server-side request forgery in platform from shopware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the Admin SDK functionality on the server to read or update internal resources. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | shopware/core | 6.4.10.1 | GHSA-7gm7-8q8v-9gf2 |
| Packagist | shopware/platform | 6.4.10.1 | GHSA-7gm7-8q8v-9gf2 |
Affected products (as reported)
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H