shopware/core vulnerabilities

Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation

Affected

>=6.7.0.0 <6.7.10.1

Fixed in

6.7.10.1

Shopware: Stored XSS via SVG file upload — no SVG sanitization

Affected

>=6.7.0.0 <6.7.10.1 · <6.6.10.18

Fixed in

6.6.10.18, 6.7.10.1

Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment

Affected

>=6.7.0.0 <6.7.10.1 · <6.6.10.18

Fixed in

6.6.10.18, 6.7.10.1

Shopware: Admin API ACL Bypass in Order State Transition Endpoints

Affected

>=6.7.0.0 <6.7.10.1 · <6.6.10.18

Fixed in

6.6.10.18, 6.7.10.1

Shopware SSO referer trust leading to an arbitrary redirect target

Affected

>=6.7.3.0 <6.7.10.1

Fixed in

6.7.10.1

Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames

Affected

>=6.7.0.0 <6.7.10.1 · <6.6.10.18

Fixed in

6.6.10.18, 6.7.10.1

Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts

Affected

>=6.7.0.0 <6.7.10.1 · <6.6.10.18

Fixed in

6.6.10.18, 6.7.10.1

Shopware: Admin Account Takeover via User Recovery Hash Exposure

Affected

>=6.7.0.0 <6.7.10.1 · <6.6.10.18

Fixed in

6.6.10.18, 6.7.10.1

Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass

Affected

>=6.7.0.0 <6.7.10.1 · <6.6.10.18

Fixed in

6.6.10.18, 6.7.10.1

Shopware vulnerable to a potential take over of app credentials

Affected

>=6.7.0.0 <6.7.8.1 · <6.6.10.15

Fixed in

6.6.10.15, 6.7.8.1

Shopware has user enumeration via distinct error codes on Store API login endpoint

Affected

>=6.7.0.0 <6.7.8.1 · <6.6.10.15

Fixed in

6.6.10.15, 6.7.8.1

Shopware: Unauthenticated data extraction possible through store-api.order endpoint

Affected

>=6.7.0.0 <6.7.8.1 · <6.6.10.15

Fixed in

6.6.10.15, 6.7.8.1

Shopware Has Improper Control of Generation of Code in Twig rendered views

Affected

>=6.7.0.0 <6.7.6.1

Fixed in

6.7.6.1

Shopware 6's password recovery link does not expire after email change

Affected

<6.6.10.9 · >=6.7.0.0 <6.7.4.1

Fixed in

6.6.10.9, 6.7.4.1

Shopware Customer Orders can be canceled, even if refunds are disabled

Affected

>=6.7.0.0 <6.7.3.1 · <6.6.10.7

Fixed in

6.6.10.7, 6.7.3.1

Shopware exposes sensitive user information via CSV export mapping

Affected

>=6.7.0.0 <6.7.3.1 · <6.6.10.7

Fixed in

6.6.10.7, 6.7.3.1

Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice

Affected

>=6.7.0.0 <6.7.3.1 · <6.6.10.7

Fixed in

6.6.10.7, 6.7.3.1

Shopware vulnerable to path traversal via Plugin upload

Affected

>=6.7.0.0 <6.7.3.1 · <6.6.10.7

Fixed in

6.6.10.7, 6.7.3.1

Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually

Affected

>=6.7.0.0 <6.7.3.1 · <6.6.10.7

Fixed in

6.6.10.7, 6.7.3.1

Shopware: Reflective Cross Site-Scripting (XSS) in CMS components

Affected

>=6.7.0.0 <6.7.2.1

Fixed in

6.7.2.1

Shopware default newsletter opt-in settings allow for mass sign-up abuse

Affected

>=6.6.0.0-rc1 <6.6.10.3 · >=6.7.0.0-rc1 <6.7.0.0-rc2 · <6.5.8.17

Fixed in

6.5.8.17, 6.6.10.3, 6.7.0.0-rc2

Shopware Broken ACL on Document retrieval to access other customers documents

Affected

>=6.6.0.0 <6.6.10.3 · >=6.7.0.0-rc1 <6.7.0.0-rc2 · <6.5.8.17

Fixed in

6.5.8.17, 6.6.10.3, 6.7.0.0-rc2

Shopware Vulnerable to Blind SQL-injection in DAL aggregations

Affected

>=6.7.0.0-rc1 <6.7.0.0-rc2 · >=6.6.0.0 <6.6.10.3 · <6.5.8.18

Fixed in

6.5.8.18, 6.6.10.3, 6.7.0.0-rc2

Shopware allows Denial Of Service via password length

Affected

>=6.6.0.0 <6.6.10.3 · >=6.7.0.0-rc1 <6.7.0.0-rc2 · <6.5.8.17

Fixed in

6.5.8.17, 6.6.10.3, 6.7.0.0-rc2

Shopware 6 allows attackers to check for registered accounts through the store-api

Affected

>=6.6.0.0 <6.6.10.3 · >=6.7.0.0-rc1 <6.7.0.0-rc2 · <6.5.8.18

Fixed in

6.5.8.18, 6.6.10.3, 6.7.0.0-rc2

Shopware vulnerable to blind SQL-injection in DAL aggregations

Affected

<6.5.8.13 · >=6.6.0.0 <6.6.5.1

Fixed in

6.5.8.13, 6.6.5.1

Shopware vulnerable to Server Side Template Injection in Twig using Context functions

Affected

<6.5.8.13 · >=6.6.0.0 <6.6.5.1

Fixed in

6.5.8.13, 6.6.5.1

Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag

Affected

<6.5.8.13 · >=6.6.0.0 <6.6.5.1

Fixed in

6.5.8.13, 6.6.5.1

Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api

Affected

<6.5.8.13 · >=6.6.0.0 <6.6.5.1

Fixed in

6.5.8.13, 6.6.5.1

Shopware Improper Session Handling in store-api account logout

Affected

>=6.3.5.0 <6.5.8.8 · >=6.6.0.0-rc1 <6.6.1.0

Fixed in

6.5.8.8, 6.6.1.0

Broken Access Control order API in Shopware

Affected

<6.5.7.4

Fixed in

6.5.7.4

Blind SQL injection in shopware

Affected

<6.5.7.4

Fixed in

6.5.7.4

Shopware Has Improper Control of Generation of Code in Twig rendered views

Affected

<6.4.20.1

Fixed in

6.4.20.1

Shopware has Improper Input Validation issue in newsletter subscription

Affected

<6.4.18.1

Fixed in

6.4.18.1

Shopware has Insufficient Session Expiration in Administration

Affected

<6.4.18.1

Fixed in

6.4.18.1

Shopware's log module vulnerable to Improper Output Neutralization

Affected

<6.4.18.1

Fixed in

6.4.18.1

Shopware vulnerable to Improper Control of Generation of Code in Twig rendered views

Affected

<6.4.18.1

Fixed in

6.4.18.1

Shopware vulnerable to Improper Input Validation of Clearance sale in cart

Affected

<6.4.18.1

Fixed in

6.4.18.1

Shopware database password is leaked to an unauthenticated users

Affected

>=6.0.0 <6.2.3

Fixed in

6.2.3

Improper Access Control in Shopware

Affected

<6.4.10.1

Fixed in

6.4.10.1

Server-Side Request Forgery (SSRF) in Shopware

Affected

<6.4.10.1

Fixed in

6.4.10.1

Incorrect Authentication in shopware

Affected

<6.4.8.2

Fixed in

6.4.8.2

HTTP caching is marking private HTTP headers as public in Shopware

Affected

<6.4.8.2

Fixed in

6.4.8.2

HTML injection possibility in voucher code form in Shopware

Affected

<6.4.8.1

Fixed in

6.4.8.1

Shopware user session is not logged out if the password is reset via password recovery

Affected

<6.4.8.1

Fixed in

6.4.8.1

Webcache Poisoning in shopware/platform and shopware/core

Affected

<6.4.6.1

Fixed in

6.4.6.1

Insecure direct object reference of log files of the Import/Export feature

Affected

<6.4.3.1

Fixed in

6.4.3.1

Command injection in mail agent settings

Affected

<6.4.3.1

Fixed in

6.4.3.1

Manipulation of product reviews via API

Affected

<6.4.3.1

Fixed in

6.4.3.1

Cross-Site Scripting via SVG media files

Affected

<6.4.3.1

Fixed in

6.4.3.1

Authenticated server-side request forgery in file upload via URL.

Affected

<6.4.3.1

Fixed in

6.4.3.1

non-admin users can create integration role with administrator role

Affected

<6.4.1.1

Fixed in

6.4.1.1

Internal hidden fields are visible on to many associations in admin api

Affected

<6.4.1.1

Fixed in

6.4.1.1

Private files publicly accessible with Cloud Storage providers

Affected

<6.4.1.1

Fixed in

6.4.1.1

Creation of order credits was not validated by acl in admin orders

Affected

<6.4.1.1

Fixed in

6.4.1.1

Canceling of orders not related to the logged-in user

Affected

<6.4.1.1

Fixed in

6.4.1.1

After order payment process manipulation in shopware/platform and shopware/core

Affected

<6.3.5.3

Fixed in

6.3.5.3

Leak of information via Store-API aggregations in shopware/platform and shopware/core

Affected

<6.3.5.3

Fixed in

6.3.5.3

Authenticated Server Side Request Forgery

Affected

<6.3.4.1

Fixed in

6.3.4.1

Information exposure via query strings in URL

Affected

<6.3.4.1

Fixed in

6.3.4.1

Authenticated Privilege Escalation

Affected

<6.3.4.1

Fixed in

6.3.4.1

Denial of Service via Cache Flooding

Affected

<6.3.2.1

Fixed in

6.3.2.1

Authenticated XML External Entity Processing

Affected

<6.3.2.1

Fixed in

6.3.2.1

Non-persistent XSS in the Storefront in Shopware

Affected

<6.3.1.1

Fixed in

6.3.1.1

RCE in Third Party Library in Shopware

Affected

<6.3.1.1

Fixed in

6.3.1.1