Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS03Z203LThxOHYtOWdmMs0_qg

Server-Side Request Forgery (SSRF) in Shopware

Impact

The attacker can abuse the Admin SDK functionality on the server to read or update internal resources.

Patches

We recommend updating to the current version 6.4.10.1. You can get the update to 6.4.10.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

Workarounds

For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Permalink: https://github.com/advisories/GHSA-7gm7-8q8v-9gf2
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03Z203LThxOHYtOWdmMs0_qg
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: almost 2 years ago

CVSS Score: 7.2
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-7gm7-8q8v-9gf2, CVE-2022-24871
References:

• https://github.com/shopware/platform/security/advisories/GHSA-7gm7-8q8v-9gf2
• https://nvd.nist.gov/vuln/detail/CVE-2022-24871
• https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77c
• https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022
• https://github.com/advisories/GHSA-7gm7-8q8v-9gf2

Repository: https://github.com/shopware/platform
Blast Radius: 17.8

Affected Packages