GHSA-8pfh-mm2g-hmc3LowDisclosed before NVD

Authenticated Server Side Request Forgery

Published
December 21, 2020
Last Modified
January 9, 2023

📋 Description

Impact

Authenticated Server Side Request Forgery

Patches

We recommend to update to the current version 6.3.4.1. You can get the update to 6.3.4.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

Workarounds

For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

For more information

https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-12-2020

Credits

We would like to thank REQON B.V. for reporting this issue.

🎯 Affected products2

  • composer/shopware/platform:<= 6.3.4.0
  • composer/shopware/core:<= 6.3.4.0

🔗 References (2)