Internal hidden fields are visible on to many associations in admin api

Impact

Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been loaded with a to many reference. Users are recommend to update to version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

Original source description

References

• Security advisory github.com/shopware/platform/security/advisories/GHSA-gpmh-g94g-qrhr
• Security advisory nvd.nist.gov/vuln/detail/CVE-2021-32716
• Patch github.com/shopware/platform/commit/b5c3ce3e93bd121324d72aa9d367cb636ff1c0eb
• Security advisory docs.shopware.com/en/shopware-6-en/security-updates/security-update-06-2021