What is GHSA-cj2f-96jq-phpp?

GHSA-cj2f-96jq-phpp is a security advisory published by GitHub Security Advisories with Critical severity. Shopware RCE Vulnerability

Which CVE IDs does GHSA-cj2f-96jq-phpp cover?

GHSA-cj2f-96jq-phpp covers the following CVE IDs: CVE-2016-3109. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cj2f-96jq-phpp?

GHSA-cj2f-96jq-phpp has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-cj2f-96jq-phpp?

GHSA-cj2f-96jq-phpp affects 2 products, including: composer/shopware/shopware:\u003c 4.3.7; composer/shopware/shopware:\u003e= 5.0.0, \u003c 5.1.5.

GHSA-cj2f-96jq-phppCriticalCVSS 9.8

Shopware RCE Vulnerability

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

February 7, 2024

🔗 CVE IDs covered (1)

CVE-2016-3109 →

📋 Description

The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code.

🎯 Affected products2

composer/shopware/shopware:< 4.3.7
composer/shopware/shopware:>= 5.0.0, < 5.1.5

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2016-3109
https://github.com/shopware/shopware/commit/d73e9031a5b2ab6e918eb86d1e2b2e873cd3558d
http://packetstormsecurity.com/files/136781/Shopware-Remote-Code-Execution.html
https://web.archive.org/web/20200814090044/http://www.securityfocus.com/archive/1/538173/100/0/threaded
https://web.archive.org/web/20210125193827/http://www.securityfocus.com/bid/97979
https://community.shopware.com/_detail_1918.html
https://github.com/FriendsOfPHP/security-advisories/blob/master/shopware/shopware/CVE-2016-3109.yaml
https://github.com/advisories/GHSA-cj2f-96jq-phpp