Shopware database password is leaked to an unauthenticated users
The advisory, in context
In Shopware 6 before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled. This vulnerability does not affect the shopware 5 release branch (shopware/shopware on packagist).
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 6.0.0 before 6.2.3
Fixed in 6.2.3
15 explicitly affected versions
v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.2.3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v6.1.0",
"v6.1.0-rc1",
"v6.1.0-rc2",
"v6.1.0-rc3",
"v6.1.0-rc4",
"v6.1.1",
"v6.1.2",
"v6.1.3",
"v6.1.4",
"v6.1.5",
"v6.1.6",
"v6.2.0",
"v6.2.0-RC1",
"v6.2.1",
"v6.2.2"
]
}From 6.0.0 before 6.2.3
Fixed in 6.2.3
15 explicitly affected versions
v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.2.3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v6.1.0",
"v6.1.0-rc1",
"v6.1.0-rc2",
"v6.1.0-rc3",
"v6.1.0-rc4",
"v6.1.1",
"v6.1.2",
"v6.1.3",
"v6.1.4",
"v6.1.5",
"v6.1.6",
"v6.2.0",
"v6.2.0-RC1",
"v6.2.1",
"v6.2.2"
]
}