Skip to content

Leak of information via Store-API

Critical severity GitHub Reviewed Published Feb 8, 2021 in shopware/shopware • Updated Jan 9, 2023

Package

composer shopware/platform (Composer)

Affected versions

<= 6.3.5.0

Patched versions

6.3.5.1

Description

Impact

Leak of information via Store-API

Patches

We recommend to update to the current version 6.3.5.1. You can get the update to 6.3.5.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

The vulnerability could only be fixed by changing the API system, which involves a non-backward-compatible change. Only consumers of the Store-API should be affected by this change. Please check your plugins if you have it in use. Detailed technical information can be found in the upgrade information.

https://github.com/shopware/platform/blob/v6.3.5.1/UPGRADE-6.3.md#6351

Workarounds

For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

For more information

https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2021

References

@Phil23 Phil23 published to shopware/shopware Feb 8, 2021
Reviewed Feb 10, 2021
Published to the GitHub Advisory Database Feb 10, 2021
Last updated Jan 9, 2023

Severity

Critical

Weaknesses

CVE ID

No known CVE

GHSA ID

GHSA-f2vv-h5x4-57gr

Source code

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.