In Shopware 6 before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled. This vulnerability does not affect the shopware 5 release branch (shopware/shopware on packagist).
GSA_kwCzR0hTQS1yNHBoLW14NjcteDU4cM4AAleY
Shopware database password is leaked to an unauthenticated users
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
| packagist:shopware/platform | >= 6.0.0, < 6.2.3 | 6.2.3 | |
Affected Version RangesAll affected versions6.0.0, 6.1.0, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.2.0, 6.2.1, 6.2.2 All unaffected versions5.3.1, 6.2.3 |
|||
| packagist:shopware/core | >= 6.0.0, < 6.2.3 | 6.2.3 | |
Affected Version RangesAll affected versions6.0.0, 6.1.0, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.2.0, 6.2.1, 6.2.2 All unaffected versions6.2.3 |
|||