GHSA-83jv-4prm-34g7critical9.8No CVE assigned
Shopware Remote Code Execution Vulnerability
Impact
Under certain circumstances it is possible to execute an authorized foreign code in Shopware version prior to 5.2.25.
Source excerpt · OSVApplies when
Under certain circumstances it is possible to execute an authorized foreign code in Shopware version prior to 5.2.25.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
shopware/shopware Packagist
| Affected range | Recorded fix |
|---|---|
| From 4.2.0 before 5.2.25Ecosystem versions | 5.2.25 |
Version evidence: OSV · GHSA-83jv-4prm-34g7
View original version evidence (67 explicit versions)
Original source description
Under certain circumstances it is possible to execute an authorized foreign code in Shopware version prior to 5.2.25.
References
- Patch github.com/shopware5/shopware/commit/8f6a7cefcba7547276892b82f64e4874c1a0dfed
- Source reference community.shopware.com/_detail_2015.html
- Security advisory docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2017
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/shopware/shopware/2017-06-22.yaml
- Source reference github.com/shopware5/shopware