shopware/core (Packagist)

medium4.1

GHSA-gq96-5pfx-f4vcFix available

Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation

04 Jun

shopware/core Packagist

Ecosystem versions

From 6.7.0.0 before 6.7.10.1

Fixed in 6.7.10.1

26 explicitly affected versions

v6.7.0.0, v6.7.0.1, v6.7.1.0, v6.7.1.1, v6.7.1.2, v6.7.10.0, v6.7.2.0, v6.7.2.1, v6.7.2.2, v6.7.3.0, v6.7.3.1, v6.7.4.0, v6.7.4.1, v6.7.4.2, v6.7.5.0, v6.7.5.1, v6.7.6.0, v6.7.6.1, v6.7.6.2, v6.7.7.0, v6.7.7.1, v6.7.8.0, v6.7.8.1, v6.7.8.2, v6.7.9.0, v6.7.9.1

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "6.7.0.0"
        },
        {
          "fixed": "6.7.10.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v6.7.0.0",
    "v6.7.0.1",
    "v6.7.1.0",
    "v6.7.1.1",
    "v6.7.1.2",
    "v6.7.10.0",
    "v6.7.2.0",
    "v6.7.2.1",
    "v6.7.2.2",
    "v6.7.3.0",
    "v6.7.3.1",
    "v6.7.4.0",
    "v6.7.4.1",
    "v6.7.4.2",
    "v6.7.5.0",
    "v6.7.5.1",
    "v6.7.6.0",
    "v6.7.6.1",
    "v6.7.6.2",
    "v6.7.7.0",
    "v6.7.7.1",
    "v6.7.8.0",
    "v6.7.8.1",
    "v6.7.8.2",
    "v6.7.9.0",
    "v6.7.9.1"
  ]
}

medium4.3

GHSA-9v5m-39wh-5chqFix available

Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment

Packagist / shopware/platform Packagist / shopware/core

04 Jun

shopware/core Packagist

Ecosystem versions

From 6.7.0.0 before 6.7.10.1

Fixed in 6.7.10.1

26 explicitly affected versions

v6.7.0.0, v6.7.0.1, v6.7.1.0, v6.7.1.1, v6.7.1.2, v6.7.10.0, v6.7.2.0, v6.7.2.1, v6.7.2.2, v6.7.3.0, v6.7.3.1, v6.7.4.0, v6.7.4.1, v6.7.4.2, v6.7.5.0, v6.7.5.1, v6.7.6.0, v6.7.6.1, v6.7.6.2, v6.7.7.0, v6.7.7.1, v6.7.8.0, v6.7.8.1, v6.7.8.2, v6.7.9.0, v6.7.9.1

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "6.7.0.0"
        },
        {
          "fixed": "6.7.10.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v6.7.0.0",
    "v6.7.0.1",
    "v6.7.1.0",
    "v6.7.1.1",
    "v6.7.1.2",
    "v6.7.10.0",
    "v6.7.2.0",
    "v6.7.2.1",
    "v6.7.2.2",
    "v6.7.3.0",
    "v6.7.3.1",
    "v6.7.4.0",
    "v6.7.4.1",
    "v6.7.4.2",
    "v6.7.5.0",
    "v6.7.5.1",
    "v6.7.6.0",
    "v6.7.6.1",
    "v6.7.6.2",
    "v6.7.7.0",
    "v6.7.7.1",
    "v6.7.8.0",
    "v6.7.8.1",
    "v6.7.8.2",
    "v6.7.9.0",
    "v6.7.9.1"
  ]
}

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.6.10.18

Fixed in 6.6.10.18

166 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.10.0, 6.4.10.1, 6.4.11.0, 6.4.11.1, 6.4.12.0, 6.4.13.0, 6.4.14.0, 6.4.15.0, 6.4.15.1, 6.4.15.2, 6.4.16.0, 6.4.16.1, 6.4.17.0, 6.4.17.1, 6.4.17.2, 6.4.18.0, 6.4.18.1, 6.4.19.0, 6.4.2.0, 6.4.2.1, 6.4.20.0, 6.4.20.1, 6.4.20.2, 6.4.3.0, 6.4.3.1, 6.4.4.0, 6.4.4.1, 6.4.5.0, 6.4.5.1, 6.4.6.0, 6.4.6.1, 6.4.7.0, 6.4.8.0, 6.4.8.1, 6.4.8.2, 6.4.9.0, 6.5.0.0, 6.5.0.0-rc1, 6.5.0.0-rc2, 6.5.0.0-rc3, 6.5.0.0-rc4, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3, v6.5.1.0, v6.5.1.1, v6.5.2.0, v6.5.2.1, v6.5.3.0, v6.5.3.1, v6.5.3.2, v6.5.3.3, v6.5.4.0, v6.5.4.1, v6.5.5.0, v6.5.5.1, v6.5.5.2, v6.5.6.0, v6.5.6.1, v6.5.7.0, v6.5.7.1, v6.5.7.2, v6.5.7.3, v6.5.7.4, v6.5.8.0, v6.5.8.1, v6.5.8.10, v6.5.8.11, v6.5.8.12, v6.5.8.13, v6.5.8.14, v6.5.8.15, v6.5.8.16, v6.5.8.17, v6.5.8.18, v6.5.8.19, v6.5.8.2, v6.5.8.3, v6.5.8.4, v6.5.8.5, v6.5.8.6, v6.5.8.7, v6.5.8.8, v6.5.8.9, v6.6.0.0, v6.6.0.0-rc1, v6.6.0.0-rc2, v6.6.0.0-rc3, v6.6.0.0-rc4, v6.6.0.0-rc5, v6.6.0.0-rc6, v6.6.0.0-rc7, v6.6.0.1, v6.6.0.2, v6.6.0.3, v6.6.1.0, v6.6.1.1, v6.6.1.2, v6.6.10.0, v6.6.10.1, v6.6.10.10, v6.6.10.11, v6.6.10.12, v6.6.10.13, v6.6.10.14, v6.6.10.15, v6.6.10.16, v6.6.10.17, v6.6.10.2, v6.6.10.3, v6.6.10.4, v6.6.10.5, v6.6.10.6, v6.6.10.7, v6.6.10.8, v6.6.10.9, v6.6.2.0, v6.6.3.0, v6.6.3.1, v6.6.4.0, v6.6.4.1, v6.6.5.0, v6.6.5.1, v6.6.6.0, v6.6.6.1, v6.6.7.0, v6.6.7.1, v6.6.8.0, v6.6.8.1, v6.6.8.2, v6.6.9.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.6.10.18"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "6.4.1.1",
    "6.4.1.2",
    "6.4.10.0",
    "6.4.10.1",
    "6.4.11.0",
    "6.4.11.1",
    "6.4.12.0",
    "6.4.13.0",
    "6.4.14.0",
    "6.4.15.0",
    "6.4.15.1",
    "6.4.15.2",
    "6.4.16.0",
    "6.4.16.1",
    "6.4.17.0",
    "6.4.17.1",
    "6.4.17.2",
    "6.4.18.0",
    "6.4.18.1",
    "6.4.19.0",
    "6.4.2.0",
    "6.4.2.1",
    "6.4.20.0",
    "6.4.20.1",
    "6.4.20.2",
    "6.4.3.0",
    "6.4.3.1",
    "6.4.4.0",
    "6.4.4.1",
    "6.4.5.0",
    "6.4.5.1",
    "6.4.6.0",
    "6.4.6.1",
    "6.4.7.0",
    "6.4.8.0",
    "6.4.8.1",
    "6.4.8.2",
    "6.4.9.0",
    "6.5.0.0",
    "6.5.0.0-rc1",
    "6.5.0.0-rc2",
    "6.5.0.0-rc3",
    "6.5.0.0-rc4",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3",
    "v6.5.1.0",
    "v6.5.1.1",
    "v6.5.2.0",
    "v6.5.2.1",
    "v6.5.3.0",
    "v6.5.3.1",
    "v6.5.3.2",
    "v6.5.3.3",
    "v6.5.4.0",
    "v6.5.4.1",
    "v6.5.5.0",
    "v6.5.5.1",
    "v6.5.5.2",
    "v6.5.6.0",
    "v6.5.6.1",
    "v6.5.7.0",
    "v6.5.7.1",
    "v6.5.7.2",
    "v6.5.7.3",
    "v6.5.7.4",
    "v6.5.8.0",
    "v6.5.8.1",
    "v6.5.8.10",
    "v6.5.8.11",
    "v6.5.8.12",
    "v6.5.8.13",
    "v6.5.8.14",
    "v6.5.8.15",
    "v6.5.8.16",
    "v6.5.8.17",
    "v6.5.8.18",
    "v6.5.8.19",
    "v6.5.8.2",
    "v6.5.8.3",
    "v6.5.8.4",
    "v6.5.8.5",
    "v6.5.8.6",
    "v6.5.8.7",
    "v6.5.8.8",
    "v6.5.8.9",
    "v6.6.0.0",
    "v6.6.0.0-rc1",
    "v6.6.0.0-rc2",
    "v6.6.0.0-rc3",
    "v6.6.0.0-rc4",
    "v6.6.0.0-rc5",
    "v6.6.0.0-rc6",
    "v6.6.0.0-rc7",
    "v6.6.0.1",
    "v6.6.0.2",
    "v6.6.0.3",
    "v6.6.1.0",
    "v6.6.1.1",
    "v6.6.1.2",
    "v6.6.10.0",
    "v6.6.10.1",
    "v6.6.10.10",
    "v6.6.10.11",
    "v6.6.10.12",
    "v6.6.10.13",
    "v6.6.10.14",
    "v6.6.10.15",
    "v6.6.10.16",
    "v6.6.10.17",
    "v6.6.10.2",
    "v6.6.10.3",
    "v6.6.10.4",
    "v6.6.10.5",
    "v6.6.10.6",
    "v6.6.10.7",
    "v6.6.10.8",
    "v6.6.10.9",
    "v6.6.2.0",
    "v6.6.3.0",
    "v6.6.3.1",
    "v6.6.4.0",
    "v6.6.4.1",
    "v6.6.5.0",
    "v6.6.5.1",
    "v6.6.6.0",
    "v6.6.6.1",
    "v6.6.7.0",
    "v6.6.7.1",
    "v6.6.8.0",
    "v6.6.8.1",
    "v6.6.8.2",
    "v6.6.9.0"
  ]
}

medium6.5

GHSA-f8q6-3g5w-jjr6Fix available

Shopware: Admin API ACL Bypass in Order State Transition Endpoints

Packagist / shopware/platform Packagist / shopware/core

04 Jun

shopware/core Packagist

Ecosystem versions

From 6.7.0.0 before 6.7.10.1

Fixed in 6.7.10.1

26 explicitly affected versions

v6.7.0.0, v6.7.0.1, v6.7.1.0, v6.7.1.1, v6.7.1.2, v6.7.10.0, v6.7.2.0, v6.7.2.1, v6.7.2.2, v6.7.3.0, v6.7.3.1, v6.7.4.0, v6.7.4.1, v6.7.4.2, v6.7.5.0, v6.7.5.1, v6.7.6.0, v6.7.6.1, v6.7.6.2, v6.7.7.0, v6.7.7.1, v6.7.8.0, v6.7.8.1, v6.7.8.2, v6.7.9.0, v6.7.9.1

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "6.7.0.0"
        },
        {
          "fixed": "6.7.10.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v6.7.0.0",
    "v6.7.0.1",
    "v6.7.1.0",
    "v6.7.1.1",
    "v6.7.1.2",
    "v6.7.10.0",
    "v6.7.2.0",
    "v6.7.2.1",
    "v6.7.2.2",
    "v6.7.3.0",
    "v6.7.3.1",
    "v6.7.4.0",
    "v6.7.4.1",
    "v6.7.4.2",
    "v6.7.5.0",
    "v6.7.5.1",
    "v6.7.6.0",
    "v6.7.6.1",
    "v6.7.6.2",
    "v6.7.7.0",
    "v6.7.7.1",
    "v6.7.8.0",
    "v6.7.8.1",
    "v6.7.8.2",
    "v6.7.9.0",
    "v6.7.9.1"
  ]
}

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.6.10.18

Fixed in 6.6.10.18

166 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.10.0, 6.4.10.1, 6.4.11.0, 6.4.11.1, 6.4.12.0, 6.4.13.0, 6.4.14.0, 6.4.15.0, 6.4.15.1, 6.4.15.2, 6.4.16.0, 6.4.16.1, 6.4.17.0, 6.4.17.1, 6.4.17.2, 6.4.18.0, 6.4.18.1, 6.4.19.0, 6.4.2.0, 6.4.2.1, 6.4.20.0, 6.4.20.1, 6.4.20.2, 6.4.3.0, 6.4.3.1, 6.4.4.0, 6.4.4.1, 6.4.5.0, 6.4.5.1, 6.4.6.0, 6.4.6.1, 6.4.7.0, 6.4.8.0, 6.4.8.1, 6.4.8.2, 6.4.9.0, 6.5.0.0, 6.5.0.0-rc1, 6.5.0.0-rc2, 6.5.0.0-rc3, 6.5.0.0-rc4, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3, v6.5.1.0, v6.5.1.1, v6.5.2.0, v6.5.2.1, v6.5.3.0, v6.5.3.1, v6.5.3.2, v6.5.3.3, v6.5.4.0, v6.5.4.1, v6.5.5.0, v6.5.5.1, v6.5.5.2, v6.5.6.0, v6.5.6.1, v6.5.7.0, v6.5.7.1, v6.5.7.2, v6.5.7.3, v6.5.7.4, v6.5.8.0, v6.5.8.1, v6.5.8.10, v6.5.8.11, v6.5.8.12, v6.5.8.13, v6.5.8.14, v6.5.8.15, v6.5.8.16, v6.5.8.17, v6.5.8.18, v6.5.8.19, v6.5.8.2, v6.5.8.3, v6.5.8.4, v6.5.8.5, v6.5.8.6, v6.5.8.7, v6.5.8.8, v6.5.8.9, v6.6.0.0, v6.6.0.0-rc1, v6.6.0.0-rc2, v6.6.0.0-rc3, v6.6.0.0-rc4, v6.6.0.0-rc5, v6.6.0.0-rc6, v6.6.0.0-rc7, v6.6.0.1, v6.6.0.2, v6.6.0.3, v6.6.1.0, v6.6.1.1, v6.6.1.2, v6.6.10.0, v6.6.10.1, v6.6.10.10, v6.6.10.11, v6.6.10.12, v6.6.10.13, v6.6.10.14, v6.6.10.15, v6.6.10.16, v6.6.10.17, v6.6.10.2, v6.6.10.3, v6.6.10.4, v6.6.10.5, v6.6.10.6, v6.6.10.7, v6.6.10.8, v6.6.10.9, v6.6.2.0, v6.6.3.0, v6.6.3.1, v6.6.4.0, v6.6.4.1, v6.6.5.0, v6.6.5.1, v6.6.6.0, v6.6.6.1, v6.6.7.0, v6.6.7.1, v6.6.8.0, v6.6.8.1, v6.6.8.2, v6.6.9.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.6.10.18"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "6.4.1.1",
    "6.4.1.2",
    "6.4.10.0",
    "6.4.10.1",
    "6.4.11.0",
    "6.4.11.1",
    "6.4.12.0",
    "6.4.13.0",
    "6.4.14.0",
    "6.4.15.0",
    "6.4.15.1",
    "6.4.15.2",
    "6.4.16.0",
    "6.4.16.1",
    "6.4.17.0",
    "6.4.17.1",
    "6.4.17.2",
    "6.4.18.0",
    "6.4.18.1",
    "6.4.19.0",
    "6.4.2.0",
    "6.4.2.1",
    "6.4.20.0",
    "6.4.20.1",
    "6.4.20.2",
    "6.4.3.0",
    "6.4.3.1",
    "6.4.4.0",
    "6.4.4.1",
    "6.4.5.0",
    "6.4.5.1",
    "6.4.6.0",
    "6.4.6.1",
    "6.4.7.0",
    "6.4.8.0",
    "6.4.8.1",
    "6.4.8.2",
    "6.4.9.0",
    "6.5.0.0",
    "6.5.0.0-rc1",
    "6.5.0.0-rc2",
    "6.5.0.0-rc3",
    "6.5.0.0-rc4",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3",
    "v6.5.1.0",
    "v6.5.1.1",
    "v6.5.2.0",
    "v6.5.2.1",
    "v6.5.3.0",
    "v6.5.3.1",
    "v6.5.3.2",
    "v6.5.3.3",
    "v6.5.4.0",
    "v6.5.4.1",
    "v6.5.5.0",
    "v6.5.5.1",
    "v6.5.5.2",
    "v6.5.6.0",
    "v6.5.6.1",
    "v6.5.7.0",
    "v6.5.7.1",
    "v6.5.7.2",
    "v6.5.7.3",
    "v6.5.7.4",
    "v6.5.8.0",
    "v6.5.8.1",
    "v6.5.8.10",
    "v6.5.8.11",
    "v6.5.8.12",
    "v6.5.8.13",
    "v6.5.8.14",
    "v6.5.8.15",
    "v6.5.8.16",
    "v6.5.8.17",
    "v6.5.8.18",
    "v6.5.8.19",
    "v6.5.8.2",
    "v6.5.8.3",
    "v6.5.8.4",
    "v6.5.8.5",
    "v6.5.8.6",
    "v6.5.8.7",
    "v6.5.8.8",
    "v6.5.8.9",
    "v6.6.0.0",
    "v6.6.0.0-rc1",
    "v6.6.0.0-rc2",
    "v6.6.0.0-rc3",
    "v6.6.0.0-rc4",
    "v6.6.0.0-rc5",
    "v6.6.0.0-rc6",
    "v6.6.0.0-rc7",
    "v6.6.0.1",
    "v6.6.0.2",
    "v6.6.0.3",
    "v6.6.1.0",
    "v6.6.1.1",
    "v6.6.1.2",
    "v6.6.10.0",
    "v6.6.10.1",
    "v6.6.10.10",
    "v6.6.10.11",
    "v6.6.10.12",
    "v6.6.10.13",
    "v6.6.10.14",
    "v6.6.10.15",
    "v6.6.10.16",
    "v6.6.10.17",
    "v6.6.10.2",
    "v6.6.10.3",
    "v6.6.10.4",
    "v6.6.10.5",
    "v6.6.10.6",
    "v6.6.10.7",
    "v6.6.10.8",
    "v6.6.10.9",
    "v6.6.2.0",
    "v6.6.3.0",
    "v6.6.3.1",
    "v6.6.4.0",
    "v6.6.4.1",
    "v6.6.5.0",
    "v6.6.5.1",
    "v6.6.6.0",
    "v6.6.6.1",
    "v6.6.7.0",
    "v6.6.7.1",
    "v6.6.8.0",
    "v6.6.8.1",
    "v6.6.8.2",
    "v6.6.9.0"
  ]
}

low3.7

GHSA-7w52-7jvm-m9vwFix available

Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames

Packagist / shopware/platform Packagist / shopware/core

04 Jun

shopware/core Packagist

Ecosystem versions

From 6.7.0.0 before 6.7.10.1

Fixed in 6.7.10.1

26 explicitly affected versions

v6.7.0.0, v6.7.0.1, v6.7.1.0, v6.7.1.1, v6.7.1.2, v6.7.10.0, v6.7.2.0, v6.7.2.1, v6.7.2.2, v6.7.3.0, v6.7.3.1, v6.7.4.0, v6.7.4.1, v6.7.4.2, v6.7.5.0, v6.7.5.1, v6.7.6.0, v6.7.6.1, v6.7.6.2, v6.7.7.0, v6.7.7.1, v6.7.8.0, v6.7.8.1, v6.7.8.2, v6.7.9.0, v6.7.9.1

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "6.7.0.0"
        },
        {
          "fixed": "6.7.10.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v6.7.0.0",
    "v6.7.0.1",
    "v6.7.1.0",
    "v6.7.1.1",
    "v6.7.1.2",
    "v6.7.10.0",
    "v6.7.2.0",
    "v6.7.2.1",
    "v6.7.2.2",
    "v6.7.3.0",
    "v6.7.3.1",
    "v6.7.4.0",
    "v6.7.4.1",
    "v6.7.4.2",
    "v6.7.5.0",
    "v6.7.5.1",
    "v6.7.6.0",
    "v6.7.6.1",
    "v6.7.6.2",
    "v6.7.7.0",
    "v6.7.7.1",
    "v6.7.8.0",
    "v6.7.8.1",
    "v6.7.8.2",
    "v6.7.9.0",
    "v6.7.9.1"
  ]
}

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.6.10.18

Fixed in 6.6.10.18

166 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.10.0, 6.4.10.1, 6.4.11.0, 6.4.11.1, 6.4.12.0, 6.4.13.0, 6.4.14.0, 6.4.15.0, 6.4.15.1, 6.4.15.2, 6.4.16.0, 6.4.16.1, 6.4.17.0, 6.4.17.1, 6.4.17.2, 6.4.18.0, 6.4.18.1, 6.4.19.0, 6.4.2.0, 6.4.2.1, 6.4.20.0, 6.4.20.1, 6.4.20.2, 6.4.3.0, 6.4.3.1, 6.4.4.0, 6.4.4.1, 6.4.5.0, 6.4.5.1, 6.4.6.0, 6.4.6.1, 6.4.7.0, 6.4.8.0, 6.4.8.1, 6.4.8.2, 6.4.9.0, 6.5.0.0, 6.5.0.0-rc1, 6.5.0.0-rc2, 6.5.0.0-rc3, 6.5.0.0-rc4, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3, v6.5.1.0, v6.5.1.1, v6.5.2.0, v6.5.2.1, v6.5.3.0, v6.5.3.1, v6.5.3.2, v6.5.3.3, v6.5.4.0, v6.5.4.1, v6.5.5.0, v6.5.5.1, v6.5.5.2, v6.5.6.0, v6.5.6.1, v6.5.7.0, v6.5.7.1, v6.5.7.2, v6.5.7.3, v6.5.7.4, v6.5.8.0, v6.5.8.1, v6.5.8.10, v6.5.8.11, v6.5.8.12, v6.5.8.13, v6.5.8.14, v6.5.8.15, v6.5.8.16, v6.5.8.17, v6.5.8.18, v6.5.8.19, v6.5.8.2, v6.5.8.3, v6.5.8.4, v6.5.8.5, v6.5.8.6, v6.5.8.7, v6.5.8.8, v6.5.8.9, v6.6.0.0, v6.6.0.0-rc1, v6.6.0.0-rc2, v6.6.0.0-rc3, v6.6.0.0-rc4, v6.6.0.0-rc5, v6.6.0.0-rc6, v6.6.0.0-rc7, v6.6.0.1, v6.6.0.2, v6.6.0.3, v6.6.1.0, v6.6.1.1, v6.6.1.2, v6.6.10.0, v6.6.10.1, v6.6.10.10, v6.6.10.11, v6.6.10.12, v6.6.10.13, v6.6.10.14, v6.6.10.15, v6.6.10.16, v6.6.10.17, v6.6.10.2, v6.6.10.3, v6.6.10.4, v6.6.10.5, v6.6.10.6, v6.6.10.7, v6.6.10.8, v6.6.10.9, v6.6.2.0, v6.6.3.0, v6.6.3.1, v6.6.4.0, v6.6.4.1, v6.6.5.0, v6.6.5.1, v6.6.6.0, v6.6.6.1, v6.6.7.0, v6.6.7.1, v6.6.8.0, v6.6.8.1, v6.6.8.2, v6.6.9.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.6.10.18"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "6.4.1.1",
    "6.4.1.2",
    "6.4.10.0",
    "6.4.10.1",
    "6.4.11.0",
    "6.4.11.1",
    "6.4.12.0",
    "6.4.13.0",
    "6.4.14.0",
    "6.4.15.0",
    "6.4.15.1",
    "6.4.15.2",
    "6.4.16.0",
    "6.4.16.1",
    "6.4.17.0",
    "6.4.17.1",
    "6.4.17.2",
    "6.4.18.0",
    "6.4.18.1",
    "6.4.19.0",
    "6.4.2.0",
    "6.4.2.1",
    "6.4.20.0",
    "6.4.20.1",
    "6.4.20.2",
    "6.4.3.0",
    "6.4.3.1",
    "6.4.4.0",
    "6.4.4.1",
    "6.4.5.0",
    "6.4.5.1",
    "6.4.6.0",
    "6.4.6.1",
    "6.4.7.0",
    "6.4.8.0",
    "6.4.8.1",
    "6.4.8.2",
    "6.4.9.0",
    "6.5.0.0",
    "6.5.0.0-rc1",
    "6.5.0.0-rc2",
    "6.5.0.0-rc3",
    "6.5.0.0-rc4",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3",
    "v6.5.1.0",
    "v6.5.1.1",
    "v6.5.2.0",
    "v6.5.2.1",
    "v6.5.3.0",
    "v6.5.3.1",
    "v6.5.3.2",
    "v6.5.3.3",
    "v6.5.4.0",
    "v6.5.4.1",
    "v6.5.5.0",
    "v6.5.5.1",
    "v6.5.5.2",
    "v6.5.6.0",
    "v6.5.6.1",
    "v6.5.7.0",
    "v6.5.7.1",
    "v6.5.7.2",
    "v6.5.7.3",
    "v6.5.7.4",
    "v6.5.8.0",
    "v6.5.8.1",
    "v6.5.8.10",
    "v6.5.8.11",
    "v6.5.8.12",
    "v6.5.8.13",
    "v6.5.8.14",
    "v6.5.8.15",
    "v6.5.8.16",
    "v6.5.8.17",
    "v6.5.8.18",
    "v6.5.8.19",
    "v6.5.8.2",
    "v6.5.8.3",
    "v6.5.8.4",
    "v6.5.8.5",
    "v6.5.8.6",
    "v6.5.8.7",
    "v6.5.8.8",
    "v6.5.8.9",
    "v6.6.0.0",
    "v6.6.0.0-rc1",
    "v6.6.0.0-rc2",
    "v6.6.0.0-rc3",
    "v6.6.0.0-rc4",
    "v6.6.0.0-rc5",
    "v6.6.0.0-rc6",
    "v6.6.0.0-rc7",
    "v6.6.0.1",
    "v6.6.0.2",
    "v6.6.0.3",
    "v6.6.1.0",
    "v6.6.1.1",
    "v6.6.1.2",
    "v6.6.10.0",
    "v6.6.10.1",
    "v6.6.10.10",
    "v6.6.10.11",
    "v6.6.10.12",
    "v6.6.10.13",
    "v6.6.10.14",
    "v6.6.10.15",
    "v6.6.10.16",
    "v6.6.10.17",
    "v6.6.10.2",
    "v6.6.10.3",
    "v6.6.10.4",
    "v6.6.10.5",
    "v6.6.10.6",
    "v6.6.10.7",
    "v6.6.10.8",
    "v6.6.10.9",
    "v6.6.2.0",
    "v6.6.3.0",
    "v6.6.3.1",
    "v6.6.4.0",
    "v6.6.4.1",
    "v6.6.5.0",
    "v6.6.5.1",
    "v6.6.6.0",
    "v6.6.6.1",
    "v6.6.7.0",
    "v6.6.7.1",
    "v6.6.8.0",
    "v6.6.8.1",
    "v6.6.8.2",
    "v6.6.9.0"
  ]
}

medium6.5

GHSA-v39m-97p8-gqg7Fix available

Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts

Packagist / shopware/platform Packagist / shopware/core

04 Jun

shopware/core Packagist

Ecosystem versions

From 6.7.0.0 before 6.7.10.1

Fixed in 6.7.10.1

26 explicitly affected versions

v6.7.0.0, v6.7.0.1, v6.7.1.0, v6.7.1.1, v6.7.1.2, v6.7.10.0, v6.7.2.0, v6.7.2.1, v6.7.2.2, v6.7.3.0, v6.7.3.1, v6.7.4.0, v6.7.4.1, v6.7.4.2, v6.7.5.0, v6.7.5.1, v6.7.6.0, v6.7.6.1, v6.7.6.2, v6.7.7.0, v6.7.7.1, v6.7.8.0, v6.7.8.1, v6.7.8.2, v6.7.9.0, v6.7.9.1

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "6.7.0.0"
        },
        {
          "fixed": "6.7.10.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v6.7.0.0",
    "v6.7.0.1",
    "v6.7.1.0",
    "v6.7.1.1",
    "v6.7.1.2",
    "v6.7.10.0",
    "v6.7.2.0",
    "v6.7.2.1",
    "v6.7.2.2",
    "v6.7.3.0",
    "v6.7.3.1",
    "v6.7.4.0",
    "v6.7.4.1",
    "v6.7.4.2",
    "v6.7.5.0",
    "v6.7.5.1",
    "v6.7.6.0",
    "v6.7.6.1",
    "v6.7.6.2",
    "v6.7.7.0",
    "v6.7.7.1",
    "v6.7.8.0",
    "v6.7.8.1",
    "v6.7.8.2",
    "v6.7.9.0",
    "v6.7.9.1"
  ]
}

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.6.10.18

Fixed in 6.6.10.18

166 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.10.0, 6.4.10.1, 6.4.11.0, 6.4.11.1, 6.4.12.0, 6.4.13.0, 6.4.14.0, 6.4.15.0, 6.4.15.1, 6.4.15.2, 6.4.16.0, 6.4.16.1, 6.4.17.0, 6.4.17.1, 6.4.17.2, 6.4.18.0, 6.4.18.1, 6.4.19.0, 6.4.2.0, 6.4.2.1, 6.4.20.0, 6.4.20.1, 6.4.20.2, 6.4.3.0, 6.4.3.1, 6.4.4.0, 6.4.4.1, 6.4.5.0, 6.4.5.1, 6.4.6.0, 6.4.6.1, 6.4.7.0, 6.4.8.0, 6.4.8.1, 6.4.8.2, 6.4.9.0, 6.5.0.0, 6.5.0.0-rc1, 6.5.0.0-rc2, 6.5.0.0-rc3, 6.5.0.0-rc4, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3, v6.5.1.0, v6.5.1.1, v6.5.2.0, v6.5.2.1, v6.5.3.0, v6.5.3.1, v6.5.3.2, v6.5.3.3, v6.5.4.0, v6.5.4.1, v6.5.5.0, v6.5.5.1, v6.5.5.2, v6.5.6.0, v6.5.6.1, v6.5.7.0, v6.5.7.1, v6.5.7.2, v6.5.7.3, v6.5.7.4, v6.5.8.0, v6.5.8.1, v6.5.8.10, v6.5.8.11, v6.5.8.12, v6.5.8.13, v6.5.8.14, v6.5.8.15, v6.5.8.16, v6.5.8.17, v6.5.8.18, v6.5.8.19, v6.5.8.2, v6.5.8.3, v6.5.8.4, v6.5.8.5, v6.5.8.6, v6.5.8.7, v6.5.8.8, v6.5.8.9, v6.6.0.0, v6.6.0.0-rc1, v6.6.0.0-rc2, v6.6.0.0-rc3, v6.6.0.0-rc4, v6.6.0.0-rc5, v6.6.0.0-rc6, v6.6.0.0-rc7, v6.6.0.1, v6.6.0.2, v6.6.0.3, v6.6.1.0, v6.6.1.1, v6.6.1.2, v6.6.10.0, v6.6.10.1, v6.6.10.10, v6.6.10.11, v6.6.10.12, v6.6.10.13, v6.6.10.14, v6.6.10.15, v6.6.10.16, v6.6.10.17, v6.6.10.2, v6.6.10.3, v6.6.10.4, v6.6.10.5, v6.6.10.6, v6.6.10.7, v6.6.10.8, v6.6.10.9, v6.6.2.0, v6.6.3.0, v6.6.3.1, v6.6.4.0, v6.6.4.1, v6.6.5.0, v6.6.5.1, v6.6.6.0, v6.6.6.1, v6.6.7.0, v6.6.7.1, v6.6.8.0, v6.6.8.1, v6.6.8.2, v6.6.9.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.6.10.18"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "6.4.1.1",
    "6.4.1.2",
    "6.4.10.0",
    "6.4.10.1",
    "6.4.11.0",
    "6.4.11.1",
    "6.4.12.0",
    "6.4.13.0",
    "6.4.14.0",
    "6.4.15.0",
    "6.4.15.1",
    "6.4.15.2",
    "6.4.16.0",
    "6.4.16.1",
    "6.4.17.0",
    "6.4.17.1",
    "6.4.17.2",
    "6.4.18.0",
    "6.4.18.1",
    "6.4.19.0",
    "6.4.2.0",
    "6.4.2.1",
    "6.4.20.0",
    "6.4.20.1",
    "6.4.20.2",
    "6.4.3.0",
    "6.4.3.1",
    "6.4.4.0",
    "6.4.4.1",
    "6.4.5.0",
    "6.4.5.1",
    "6.4.6.0",
    "6.4.6.1",
    "6.4.7.0",
    "6.4.8.0",
    "6.4.8.1",
    "6.4.8.2",
    "6.4.9.0",
    "6.5.0.0",
    "6.5.0.0-rc1",
    "6.5.0.0-rc2",
    "6.5.0.0-rc3",
    "6.5.0.0-rc4",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3",
    "v6.5.1.0",
    "v6.5.1.1",
    "v6.5.2.0",
    "v6.5.2.1",
    "v6.5.3.0",
    "v6.5.3.1",
    "v6.5.3.2",
    "v6.5.3.3",
    "v6.5.4.0",
    "v6.5.4.1",
    "v6.5.5.0",
    "v6.5.5.1",
    "v6.5.5.2",
    "v6.5.6.0",
    "v6.5.6.1",
    "v6.5.7.0",
    "v6.5.7.1",
    "v6.5.7.2",
    "v6.5.7.3",
    "v6.5.7.4",
    "v6.5.8.0",
    "v6.5.8.1",
    "v6.5.8.10",
    "v6.5.8.11",
    "v6.5.8.12",
    "v6.5.8.13",
    "v6.5.8.14",
    "v6.5.8.15",
    "v6.5.8.16",
    "v6.5.8.17",
    "v6.5.8.18",
    "v6.5.8.19",
    "v6.5.8.2",
    "v6.5.8.3",
    "v6.5.8.4",
    "v6.5.8.5",
    "v6.5.8.6",
    "v6.5.8.7",
    "v6.5.8.8",
    "v6.5.8.9",
    "v6.6.0.0",
    "v6.6.0.0-rc1",
    "v6.6.0.0-rc2",
    "v6.6.0.0-rc3",
    "v6.6.0.0-rc4",
    "v6.6.0.0-rc5",
    "v6.6.0.0-rc6",
    "v6.6.0.0-rc7",
    "v6.6.0.1",
    "v6.6.0.2",
    "v6.6.0.3",
    "v6.6.1.0",
    "v6.6.1.1",
    "v6.6.1.2",
    "v6.6.10.0",
    "v6.6.10.1",
    "v6.6.10.10",
    "v6.6.10.11",
    "v6.6.10.12",
    "v6.6.10.13",
    "v6.6.10.14",
    "v6.6.10.15",
    "v6.6.10.16",
    "v6.6.10.17",
    "v6.6.10.2",
    "v6.6.10.3",
    "v6.6.10.4",
    "v6.6.10.5",
    "v6.6.10.6",
    "v6.6.10.7",
    "v6.6.10.8",
    "v6.6.10.9",
    "v6.6.2.0",
    "v6.6.3.0",
    "v6.6.3.1",
    "v6.6.4.0",
    "v6.6.4.1",
    "v6.6.5.0",
    "v6.6.5.1",
    "v6.6.6.0",
    "v6.6.6.1",
    "v6.6.7.0",
    "v6.6.7.1",
    "v6.6.8.0",
    "v6.6.8.1",
    "v6.6.8.2",
    "v6.6.9.0"
  ]
}

high7.2

GHSA-7cw6-7h3h-v8pfFix available

Shopware Has Improper Control of Generation of Code in Twig rendered views

Packagist / shopware/shopware Packagist / shopware/core

14 Jan

shopware/core Packagist

Ecosystem versions

From 6.7.0.0 before 6.7.6.1

Fixed in 6.7.6.1

16 explicitly affected versions

v6.7.0.0, v6.7.0.1, v6.7.1.0, v6.7.1.1, v6.7.1.2, v6.7.2.0, v6.7.2.1, v6.7.2.2, v6.7.3.0, v6.7.3.1, v6.7.4.0, v6.7.4.1, v6.7.4.2, v6.7.5.0, v6.7.5.1, v6.7.6.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "6.7.0.0"
        },
        {
          "fixed": "6.7.6.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v6.7.0.0",
    "v6.7.0.1",
    "v6.7.1.0",
    "v6.7.1.1",
    "v6.7.1.2",
    "v6.7.2.0",
    "v6.7.2.1",
    "v6.7.2.2",
    "v6.7.3.0",
    "v6.7.3.1",
    "v6.7.4.0",
    "v6.7.4.1",
    "v6.7.4.2",
    "v6.7.5.0",
    "v6.7.5.1",
    "v6.7.6.0"
  ]
}

medium5.0

GHSA-2w46-vq8h-98vhNo CVE assignedFix available

Shopware 6's password recovery link does not expire after email change

Packagist / shopware/core

14 Nov

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.6.10.9

Fixed in 6.6.10.9

157 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.10.0, 6.4.10.1, 6.4.11.0, 6.4.11.1, 6.4.12.0, 6.4.13.0, 6.4.14.0, 6.4.15.0, 6.4.15.1, 6.4.15.2, 6.4.16.0, 6.4.16.1, 6.4.17.0, 6.4.17.1, 6.4.17.2, 6.4.18.0, 6.4.18.1, 6.4.19.0, 6.4.2.0, 6.4.2.1, 6.4.20.0, 6.4.20.1, 6.4.20.2, 6.4.3.0, 6.4.3.1, 6.4.4.0, 6.4.4.1, 6.4.5.0, 6.4.5.1, 6.4.6.0, 6.4.6.1, 6.4.7.0, 6.4.8.0, 6.4.8.1, 6.4.8.2, 6.4.9.0, 6.5.0.0, 6.5.0.0-rc1, 6.5.0.0-rc2, 6.5.0.0-rc3, 6.5.0.0-rc4, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3, v6.5.1.0, v6.5.1.1, v6.5.2.0, v6.5.2.1, v6.5.3.0, v6.5.3.1, v6.5.3.2, v6.5.3.3, v6.5.4.0, v6.5.4.1, v6.5.5.0, v6.5.5.1, v6.5.5.2, v6.5.6.0, v6.5.6.1, v6.5.7.0, v6.5.7.1, v6.5.7.2, v6.5.7.3, v6.5.7.4, v6.5.8.0, v6.5.8.1, v6.5.8.10, v6.5.8.11, v6.5.8.12, v6.5.8.13, v6.5.8.14, v6.5.8.15, v6.5.8.16, v6.5.8.17, v6.5.8.18, v6.5.8.19, v6.5.8.2, v6.5.8.3, v6.5.8.4, v6.5.8.5, v6.5.8.6, v6.5.8.7, v6.5.8.8, v6.5.8.9, v6.6.0.0, v6.6.0.0-rc1, v6.6.0.0-rc2, v6.6.0.0-rc3, v6.6.0.0-rc4, v6.6.0.0-rc5, v6.6.0.0-rc6, v6.6.0.0-rc7, v6.6.0.1, v6.6.0.2, v6.6.0.3, v6.6.1.0, v6.6.1.1, v6.6.1.2, v6.6.10.0, v6.6.10.1, v6.6.10.2, v6.6.10.3, v6.6.10.4, v6.6.10.5, v6.6.10.6, v6.6.10.7, v6.6.10.8, v6.6.2.0, v6.6.3.0, v6.6.3.1, v6.6.4.0, v6.6.4.1, v6.6.5.0, v6.6.5.1, v6.6.6.0, v6.6.6.1, v6.6.7.0, v6.6.7.1, v6.6.8.0, v6.6.8.1, v6.6.8.2, v6.6.9.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.6.10.9"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "6.4.1.1",
    "6.4.1.2",
    "6.4.10.0",
    "6.4.10.1",
    "6.4.11.0",
    "6.4.11.1",
    "6.4.12.0",
    "6.4.13.0",
    "6.4.14.0",
    "6.4.15.0",
    "6.4.15.1",
    "6.4.15.2",
    "6.4.16.0",
    "6.4.16.1",
    "6.4.17.0",
    "6.4.17.1",
    "6.4.17.2",
    "6.4.18.0",
    "6.4.18.1",
    "6.4.19.0",
    "6.4.2.0",
    "6.4.2.1",
    "6.4.20.0",
    "6.4.20.1",
    "6.4.20.2",
    "6.4.3.0",
    "6.4.3.1",
    "6.4.4.0",
    "6.4.4.1",
    "6.4.5.0",
    "6.4.5.1",
    "6.4.6.0",
    "6.4.6.1",
    "6.4.7.0",
    "6.4.8.0",
    "6.4.8.1",
    "6.4.8.2",
    "6.4.9.0",
    "6.5.0.0",
    "6.5.0.0-rc1",
    "6.5.0.0-rc2",
    "6.5.0.0-rc3",
    "6.5.0.0-rc4",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3",
    "v6.5.1.0",
    "v6.5.1.1",
    "v6.5.2.0",
    "v6.5.2.1",
    "v6.5.3.0",
    "v6.5.3.1",
    "v6.5.3.2",
    "v6.5.3.3",
    "v6.5.4.0",
    "v6.5.4.1",
    "v6.5.5.0",
    "v6.5.5.1",
    "v6.5.5.2",
    "v6.5.6.0",
    "v6.5.6.1",
    "v6.5.7.0",
    "v6.5.7.1",
    "v6.5.7.2",
    "v6.5.7.3",
    "v6.5.7.4",
    "v6.5.8.0",
    "v6.5.8.1",
    "v6.5.8.10",
    "v6.5.8.11",
    "v6.5.8.12",
    "v6.5.8.13",
    "v6.5.8.14",
    "v6.5.8.15",
    "v6.5.8.16",
    "v6.5.8.17",
    "v6.5.8.18",
    "v6.5.8.19",
    "v6.5.8.2",
    "v6.5.8.3",
    "v6.5.8.4",
    "v6.5.8.5",
    "v6.5.8.6",
    "v6.5.8.7",
    "v6.5.8.8",
    "v6.5.8.9",
    "v6.6.0.0",
    "v6.6.0.0-rc1",
    "v6.6.0.0-rc2",
    "v6.6.0.0-rc3",
    "v6.6.0.0-rc4",
    "v6.6.0.0-rc5",
    "v6.6.0.0-rc6",
    "v6.6.0.0-rc7",
    "v6.6.0.1",
    "v6.6.0.2",
    "v6.6.0.3",
    "v6.6.1.0",
    "v6.6.1.1",
    "v6.6.1.2",
    "v6.6.10.0",
    "v6.6.10.1",
    "v6.6.10.2",
    "v6.6.10.3",
    "v6.6.10.4",
    "v6.6.10.5",
    "v6.6.10.6",
    "v6.6.10.7",
    "v6.6.10.8",
    "v6.6.2.0",
    "v6.6.3.0",
    "v6.6.3.1",
    "v6.6.4.0",
    "v6.6.4.1",
    "v6.6.5.0",
    "v6.6.5.1",
    "v6.6.6.0",
    "v6.6.6.1",
    "v6.6.7.0",
    "v6.6.7.1",
    "v6.6.8.0",
    "v6.6.8.1",
    "v6.6.8.2",
    "v6.6.9.0"
  ]
}

shopware/core Packagist

Ecosystem versions

From 6.7.0.0 before 6.7.4.1

Fixed in 6.7.4.1

11 explicitly affected versions

v6.7.0.0, v6.7.0.1, v6.7.1.0, v6.7.1.1, v6.7.1.2, v6.7.2.0, v6.7.2.1, v6.7.2.2, v6.7.3.0, v6.7.3.1, v6.7.4.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "6.7.0.0"
        },
        {
          "fixed": "6.7.4.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v6.7.0.0",
    "v6.7.0.1",
    "v6.7.1.0",
    "v6.7.1.1",
    "v6.7.1.2",
    "v6.7.2.0",
    "v6.7.2.1",
    "v6.7.2.2",
    "v6.7.3.0",
    "v6.7.3.1",
    "v6.7.4.0"
  ]
}

medium4.3

GHSA-r2vg-hvjm-fg38No CVE assignedFix available

Shopware Customer Orders can be canceled, even if refunds are disabled

Packagist / shopware/platform Packagist / shopware/core

21 Oct

shopware/core Packagist

Ecosystem versions

From 6.7.0.0 before 6.7.3.1

Fixed in 6.7.3.1

9 explicitly affected versions

v6.7.0.0, v6.7.0.1, v6.7.1.0, v6.7.1.1, v6.7.1.2, v6.7.2.0, v6.7.2.1, v6.7.2.2, v6.7.3.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "6.7.0.0"
        },
        {
          "fixed": "6.7.3.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v6.7.0.0",
    "v6.7.0.1",
    "v6.7.1.0",
    "v6.7.1.1",
    "v6.7.1.2",
    "v6.7.2.0",
    "v6.7.2.1",
    "v6.7.2.2",
    "v6.7.3.0"
  ]
}

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.6.10.7

Fixed in 6.6.10.7

155 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.10.0, 6.4.10.1, 6.4.11.0, 6.4.11.1, 6.4.12.0, 6.4.13.0, 6.4.14.0, 6.4.15.0, 6.4.15.1, 6.4.15.2, 6.4.16.0, 6.4.16.1, 6.4.17.0, 6.4.17.1, 6.4.17.2, 6.4.18.0, 6.4.18.1, 6.4.19.0, 6.4.2.0, 6.4.2.1, 6.4.20.0, 6.4.20.1, 6.4.20.2, 6.4.3.0, 6.4.3.1, 6.4.4.0, 6.4.4.1, 6.4.5.0, 6.4.5.1, 6.4.6.0, 6.4.6.1, 6.4.7.0, 6.4.8.0, 6.4.8.1, 6.4.8.2, 6.4.9.0, 6.5.0.0, 6.5.0.0-rc1, 6.5.0.0-rc2, 6.5.0.0-rc3, 6.5.0.0-rc4, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3, v6.5.1.0, v6.5.1.1, v6.5.2.0, v6.5.2.1, v6.5.3.0, v6.5.3.1, v6.5.3.2, v6.5.3.3, v6.5.4.0, v6.5.4.1, v6.5.5.0, v6.5.5.1, v6.5.5.2, v6.5.6.0, v6.5.6.1, v6.5.7.0, v6.5.7.1, v6.5.7.2, v6.5.7.3, v6.5.7.4, v6.5.8.0, v6.5.8.1, v6.5.8.10, v6.5.8.11, v6.5.8.12, v6.5.8.13, v6.5.8.14, v6.5.8.15, v6.5.8.16, v6.5.8.17, v6.5.8.18, v6.5.8.19, v6.5.8.2, v6.5.8.3, v6.5.8.4, v6.5.8.5, v6.5.8.6, v6.5.8.7, v6.5.8.8, v6.5.8.9, v6.6.0.0, v6.6.0.0-rc1, v6.6.0.0-rc2, v6.6.0.0-rc3, v6.6.0.0-rc4, v6.6.0.0-rc5, v6.6.0.0-rc6, v6.6.0.0-rc7, v6.6.0.1, v6.6.0.2, v6.6.0.3, v6.6.1.0, v6.6.1.1, v6.6.1.2, v6.6.10.0, v6.6.10.1, v6.6.10.2, v6.6.10.3, v6.6.10.4, v6.6.10.5, v6.6.10.6, v6.6.2.0, v6.6.3.0, v6.6.3.1, v6.6.4.0, v6.6.4.1, v6.6.5.0, v6.6.5.1, v6.6.6.0, v6.6.6.1, v6.6.7.0, v6.6.7.1, v6.6.8.0, v6.6.8.1, v6.6.8.2, v6.6.9.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.6.10.7"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "6.4.1.1",
    "6.4.1.2",
    "6.4.10.0",
    "6.4.10.1",
    "6.4.11.0",
    "6.4.11.1",
    "6.4.12.0",
    "6.4.13.0",
    "6.4.14.0",
    "6.4.15.0",
    "6.4.15.1",
    "6.4.15.2",
    "6.4.16.0",
    "6.4.16.1",
    "6.4.17.0",
    "6.4.17.1",
    "6.4.17.2",
    "6.4.18.0",
    "6.4.18.1",
    "6.4.19.0",
    "6.4.2.0",
    "6.4.2.1",
    "6.4.20.0",
    "6.4.20.1",
    "6.4.20.2",
    "6.4.3.0",
    "6.4.3.1",
    "6.4.4.0",
    "6.4.4.1",
    "6.4.5.0",
    "6.4.5.1",
    "6.4.6.0",
    "6.4.6.1",
    "6.4.7.0",
    "6.4.8.0",
    "6.4.8.1",
    "6.4.8.2",
    "6.4.9.0",
    "6.5.0.0",
    "6.5.0.0-rc1",
    "6.5.0.0-rc2",
    "6.5.0.0-rc3",
    "6.5.0.0-rc4",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3",
    "v6.5.1.0",
    "v6.5.1.1",
    "v6.5.2.0",
    "v6.5.2.1",
    "v6.5.3.0",
    "v6.5.3.1",
    "v6.5.3.2",
    "v6.5.3.3",
    "v6.5.4.0",
    "v6.5.4.1",
    "v6.5.5.0",
    "v6.5.5.1",
    "v6.5.5.2",
    "v6.5.6.0",
    "v6.5.6.1",
    "v6.5.7.0",
    "v6.5.7.1",
    "v6.5.7.2",
    "v6.5.7.3",
    "v6.5.7.4",
    "v6.5.8.0",
    "v6.5.8.1",
    "v6.5.8.10",
    "v6.5.8.11",
    "v6.5.8.12",
    "v6.5.8.13",
    "v6.5.8.14",
    "v6.5.8.15",
    "v6.5.8.16",
    "v6.5.8.17",
    "v6.5.8.18",
    "v6.5.8.19",
    "v6.5.8.2",
    "v6.5.8.3",
    "v6.5.8.4",
    "v6.5.8.5",
    "v6.5.8.6",
    "v6.5.8.7",
    "v6.5.8.8",
    "v6.5.8.9",
    "v6.6.0.0",
    "v6.6.0.0-rc1",
    "v6.6.0.0-rc2",
    "v6.6.0.0-rc3",
    "v6.6.0.0-rc4",
    "v6.6.0.0-rc5",
    "v6.6.0.0-rc6",
    "v6.6.0.0-rc7",
    "v6.6.0.1",
    "v6.6.0.2",
    "v6.6.0.3",
    "v6.6.1.0",
    "v6.6.1.1",
    "v6.6.1.2",
    "v6.6.10.0",
    "v6.6.10.1",
    "v6.6.10.2",
    "v6.6.10.3",
    "v6.6.10.4",
    "v6.6.10.5",
    "v6.6.10.6",
    "v6.6.2.0",
    "v6.6.3.0",
    "v6.6.3.1",
    "v6.6.4.0",
    "v6.6.4.1",
    "v6.6.5.0",
    "v6.6.5.1",
    "v6.6.6.0",
    "v6.6.6.1",
    "v6.6.7.0",
    "v6.6.7.1",
    "v6.6.8.0",
    "v6.6.8.1",
    "v6.6.8.2",
    "v6.6.9.0"
  ]
}

medium4.9

GHSA-27c9-vp3w-6ww8No CVE assignedFix available

Shopware exposes sensitive user information via CSV export mapping

Packagist / shopware/platform Packagist / shopware/core

21 Oct

shopware/core Packagist

Ecosystem versions

From 6.7.0.0 before 6.7.3.1

Fixed in 6.7.3.1

9 explicitly affected versions

v6.7.0.0, v6.7.0.1, v6.7.1.0, v6.7.1.1, v6.7.1.2, v6.7.2.0, v6.7.2.1, v6.7.2.2, v6.7.3.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "6.7.0.0"
        },
        {
          "fixed": "6.7.3.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v6.7.0.0",
    "v6.7.0.1",
    "v6.7.1.0",
    "v6.7.1.1",
    "v6.7.1.2",
    "v6.7.2.0",
    "v6.7.2.1",
    "v6.7.2.2",
    "v6.7.3.0"
  ]
}

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.6.10.7

Fixed in 6.6.10.7

155 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.10.0, 6.4.10.1, 6.4.11.0, 6.4.11.1, 6.4.12.0, 6.4.13.0, 6.4.14.0, 6.4.15.0, 6.4.15.1, 6.4.15.2, 6.4.16.0, 6.4.16.1, 6.4.17.0, 6.4.17.1, 6.4.17.2, 6.4.18.0, 6.4.18.1, 6.4.19.0, 6.4.2.0, 6.4.2.1, 6.4.20.0, 6.4.20.1, 6.4.20.2, 6.4.3.0, 6.4.3.1, 6.4.4.0, 6.4.4.1, 6.4.5.0, 6.4.5.1, 6.4.6.0, 6.4.6.1, 6.4.7.0, 6.4.8.0, 6.4.8.1, 6.4.8.2, 6.4.9.0, 6.5.0.0, 6.5.0.0-rc1, 6.5.0.0-rc2, 6.5.0.0-rc3, 6.5.0.0-rc4, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3, v6.5.1.0, v6.5.1.1, v6.5.2.0, v6.5.2.1, v6.5.3.0, v6.5.3.1, v6.5.3.2, v6.5.3.3, v6.5.4.0, v6.5.4.1, v6.5.5.0, v6.5.5.1, v6.5.5.2, v6.5.6.0, v6.5.6.1, v6.5.7.0, v6.5.7.1, v6.5.7.2, v6.5.7.3, v6.5.7.4, v6.5.8.0, v6.5.8.1, v6.5.8.10, v6.5.8.11, v6.5.8.12, v6.5.8.13, v6.5.8.14, v6.5.8.15, v6.5.8.16, v6.5.8.17, v6.5.8.18, v6.5.8.19, v6.5.8.2, v6.5.8.3, v6.5.8.4, v6.5.8.5, v6.5.8.6, v6.5.8.7, v6.5.8.8, v6.5.8.9, v6.6.0.0, v6.6.0.0-rc1, v6.6.0.0-rc2, v6.6.0.0-rc3, v6.6.0.0-rc4, v6.6.0.0-rc5, v6.6.0.0-rc6, v6.6.0.0-rc7, v6.6.0.1, v6.6.0.2, v6.6.0.3, v6.6.1.0, v6.6.1.1, v6.6.1.2, v6.6.10.0, v6.6.10.1, v6.6.10.2, v6.6.10.3, v6.6.10.4, v6.6.10.5, v6.6.10.6, v6.6.2.0, v6.6.3.0, v6.6.3.1, v6.6.4.0, v6.6.4.1, v6.6.5.0, v6.6.5.1, v6.6.6.0, v6.6.6.1, v6.6.7.0, v6.6.7.1, v6.6.8.0, v6.6.8.1, v6.6.8.2, v6.6.9.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.6.10.7"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "6.4.1.1",
    "6.4.1.2",
    "6.4.10.0",
    "6.4.10.1",
    "6.4.11.0",
    "6.4.11.1",
    "6.4.12.0",
    "6.4.13.0",
    "6.4.14.0",
    "6.4.15.0",
    "6.4.15.1",
    "6.4.15.2",
    "6.4.16.0",
    "6.4.16.1",
    "6.4.17.0",
    "6.4.17.1",
    "6.4.17.2",
    "6.4.18.0",
    "6.4.18.1",
    "6.4.19.0",
    "6.4.2.0",
    "6.4.2.1",
    "6.4.20.0",
    "6.4.20.1",
    "6.4.20.2",
    "6.4.3.0",
    "6.4.3.1",
    "6.4.4.0",
    "6.4.4.1",
    "6.4.5.0",
    "6.4.5.1",
    "6.4.6.0",
    "6.4.6.1",
    "6.4.7.0",
    "6.4.8.0",
    "6.4.8.1",
    "6.4.8.2",
    "6.4.9.0",
    "6.5.0.0",
    "6.5.0.0-rc1",
    "6.5.0.0-rc2",
    "6.5.0.0-rc3",
    "6.5.0.0-rc4",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3",
    "v6.5.1.0",
    "v6.5.1.1",
    "v6.5.2.0",
    "v6.5.2.1",
    "v6.5.3.0",
    "v6.5.3.1",
    "v6.5.3.2",
    "v6.5.3.3",
    "v6.5.4.0",
    "v6.5.4.1",
    "v6.5.5.0",
    "v6.5.5.1",
    "v6.5.5.2",
    "v6.5.6.0",
    "v6.5.6.1",
    "v6.5.7.0",
    "v6.5.7.1",
    "v6.5.7.2",
    "v6.5.7.3",
    "v6.5.7.4",
    "v6.5.8.0",
    "v6.5.8.1",
    "v6.5.8.10",
    "v6.5.8.11",
    "v6.5.8.12",
    "v6.5.8.13",
    "v6.5.8.14",
    "v6.5.8.15",
    "v6.5.8.16",
    "v6.5.8.17",
    "v6.5.8.18",
    "v6.5.8.19",
    "v6.5.8.2",
    "v6.5.8.3",
    "v6.5.8.4",
    "v6.5.8.5",
    "v6.5.8.6",
    "v6.5.8.7",
    "v6.5.8.8",
    "v6.5.8.9",
    "v6.6.0.0",
    "v6.6.0.0-rc1",
    "v6.6.0.0-rc2",
    "v6.6.0.0-rc3",
    "v6.6.0.0-rc4",
    "v6.6.0.0-rc5",
    "v6.6.0.0-rc6",
    "v6.6.0.0-rc7",
    "v6.6.0.1",
    "v6.6.0.2",
    "v6.6.0.3",
    "v6.6.1.0",
    "v6.6.1.1",
    "v6.6.1.2",
    "v6.6.10.0",
    "v6.6.10.1",
    "v6.6.10.2",
    "v6.6.10.3",
    "v6.6.10.4",
    "v6.6.10.5",
    "v6.6.10.6",
    "v6.6.2.0",
    "v6.6.3.0",
    "v6.6.3.1",
    "v6.6.4.0",
    "v6.6.4.1",
    "v6.6.5.0",
    "v6.6.5.1",
    "v6.6.6.0",
    "v6.6.6.1",
    "v6.6.7.0",
    "v6.6.7.1",
    "v6.6.8.0",
    "v6.6.8.1",
    "v6.6.8.2",
    "v6.6.9.0"
  ]
}

low2.7

GHSA-6wh5-mw9h-5c3wNo CVE assignedFix available

Shopware vulnerable to path traversal via Plugin upload

Packagist / shopware/platform Packagist / shopware/core

21 Oct

shopware/core Packagist

Ecosystem versions

From 6.7.0.0 before 6.7.3.1

Fixed in 6.7.3.1

9 explicitly affected versions

v6.7.0.0, v6.7.0.1, v6.7.1.0, v6.7.1.1, v6.7.1.2, v6.7.2.0, v6.7.2.1, v6.7.2.2, v6.7.3.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "6.7.0.0"
        },
        {
          "fixed": "6.7.3.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v6.7.0.0",
    "v6.7.0.1",
    "v6.7.1.0",
    "v6.7.1.1",
    "v6.7.1.2",
    "v6.7.2.0",
    "v6.7.2.1",
    "v6.7.2.2",
    "v6.7.3.0"
  ]
}

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.6.10.7

Fixed in 6.6.10.7

155 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.10.0, 6.4.10.1, 6.4.11.0, 6.4.11.1, 6.4.12.0, 6.4.13.0, 6.4.14.0, 6.4.15.0, 6.4.15.1, 6.4.15.2, 6.4.16.0, 6.4.16.1, 6.4.17.0, 6.4.17.1, 6.4.17.2, 6.4.18.0, 6.4.18.1, 6.4.19.0, 6.4.2.0, 6.4.2.1, 6.4.20.0, 6.4.20.1, 6.4.20.2, 6.4.3.0, 6.4.3.1, 6.4.4.0, 6.4.4.1, 6.4.5.0, 6.4.5.1, 6.4.6.0, 6.4.6.1, 6.4.7.0, 6.4.8.0, 6.4.8.1, 6.4.8.2, 6.4.9.0, 6.5.0.0, 6.5.0.0-rc1, 6.5.0.0-rc2, 6.5.0.0-rc3, 6.5.0.0-rc4, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3, v6.5.1.0, v6.5.1.1, v6.5.2.0, v6.5.2.1, v6.5.3.0, v6.5.3.1, v6.5.3.2, v6.5.3.3, v6.5.4.0, v6.5.4.1, v6.5.5.0, v6.5.5.1, v6.5.5.2, v6.5.6.0, v6.5.6.1, v6.5.7.0, v6.5.7.1, v6.5.7.2, v6.5.7.3, v6.5.7.4, v6.5.8.0, v6.5.8.1, v6.5.8.10, v6.5.8.11, v6.5.8.12, v6.5.8.13, v6.5.8.14, v6.5.8.15, v6.5.8.16, v6.5.8.17, v6.5.8.18, v6.5.8.19, v6.5.8.2, v6.5.8.3, v6.5.8.4, v6.5.8.5, v6.5.8.6, v6.5.8.7, v6.5.8.8, v6.5.8.9, v6.6.0.0, v6.6.0.0-rc1, v6.6.0.0-rc2, v6.6.0.0-rc3, v6.6.0.0-rc4, v6.6.0.0-rc5, v6.6.0.0-rc6, v6.6.0.0-rc7, v6.6.0.1, v6.6.0.2, v6.6.0.3, v6.6.1.0, v6.6.1.1, v6.6.1.2, v6.6.10.0, v6.6.10.1, v6.6.10.2, v6.6.10.3, v6.6.10.4, v6.6.10.5, v6.6.10.6, v6.6.2.0, v6.6.3.0, v6.6.3.1, v6.6.4.0, v6.6.4.1, v6.6.5.0, v6.6.5.1, v6.6.6.0, v6.6.6.1, v6.6.7.0, v6.6.7.1, v6.6.8.0, v6.6.8.1, v6.6.8.2, v6.6.9.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.6.10.7"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "6.4.1.1",
    "6.4.1.2",
    "6.4.10.0",
    "6.4.10.1",
    "6.4.11.0",
    "6.4.11.1",
    "6.4.12.0",
    "6.4.13.0",
    "6.4.14.0",
    "6.4.15.0",
    "6.4.15.1",
    "6.4.15.2",
    "6.4.16.0",
    "6.4.16.1",
    "6.4.17.0",
    "6.4.17.1",
    "6.4.17.2",
    "6.4.18.0",
    "6.4.18.1",
    "6.4.19.0",
    "6.4.2.0",
    "6.4.2.1",
    "6.4.20.0",
    "6.4.20.1",
    "6.4.20.2",
    "6.4.3.0",
    "6.4.3.1",
    "6.4.4.0",
    "6.4.4.1",
    "6.4.5.0",
    "6.4.5.1",
    "6.4.6.0",
    "6.4.6.1",
    "6.4.7.0",
    "6.4.8.0",
    "6.4.8.1",
    "6.4.8.2",
    "6.4.9.0",
    "6.5.0.0",
    "6.5.0.0-rc1",
    "6.5.0.0-rc2",
    "6.5.0.0-rc3",
    "6.5.0.0-rc4",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3",
    "v6.5.1.0",
    "v6.5.1.1",
    "v6.5.2.0",
    "v6.5.2.1",
    "v6.5.3.0",
    "v6.5.3.1",
    "v6.5.3.2",
    "v6.5.3.3",
    "v6.5.4.0",
    "v6.5.4.1",
    "v6.5.5.0",
    "v6.5.5.1",
    "v6.5.5.2",
    "v6.5.6.0",
    "v6.5.6.1",
    "v6.5.7.0",
    "v6.5.7.1",
    "v6.5.7.2",
    "v6.5.7.3",
    "v6.5.7.4",
    "v6.5.8.0",
    "v6.5.8.1",
    "v6.5.8.10",
    "v6.5.8.11",
    "v6.5.8.12",
    "v6.5.8.13",
    "v6.5.8.14",
    "v6.5.8.15",
    "v6.5.8.16",
    "v6.5.8.17",
    "v6.5.8.18",
    "v6.5.8.19",
    "v6.5.8.2",
    "v6.5.8.3",
    "v6.5.8.4",
    "v6.5.8.5",
    "v6.5.8.6",
    "v6.5.8.7",
    "v6.5.8.8",
    "v6.5.8.9",
    "v6.6.0.0",
    "v6.6.0.0-rc1",
    "v6.6.0.0-rc2",
    "v6.6.0.0-rc3",
    "v6.6.0.0-rc4",
    "v6.6.0.0-rc5",
    "v6.6.0.0-rc6",
    "v6.6.0.0-rc7",
    "v6.6.0.1",
    "v6.6.0.2",
    "v6.6.0.3",
    "v6.6.1.0",
    "v6.6.1.1",
    "v6.6.1.2",
    "v6.6.10.0",
    "v6.6.10.1",
    "v6.6.10.2",
    "v6.6.10.3",
    "v6.6.10.4",
    "v6.6.10.5",
    "v6.6.10.6",
    "v6.6.2.0",
    "v6.6.3.0",
    "v6.6.3.1",
    "v6.6.4.0",
    "v6.6.4.1",
    "v6.6.5.0",
    "v6.6.5.1",
    "v6.6.6.0",
    "v6.6.6.1",
    "v6.6.7.0",
    "v6.6.7.1",
    "v6.6.8.0",
    "v6.6.8.1",
    "v6.6.8.2",
    "v6.6.9.0"
  ]
}

medium5.3

GHSA-m895-2hj3-8cg9No CVE assignedFix available

Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually

Packagist / shopware/platform Packagist / shopware/core

21 Oct

shopware/core Packagist

Ecosystem versions

From 6.7.0.0 before 6.7.3.1

Fixed in 6.7.3.1

9 explicitly affected versions

v6.7.0.0, v6.7.0.1, v6.7.1.0, v6.7.1.1, v6.7.1.2, v6.7.2.0, v6.7.2.1, v6.7.2.2, v6.7.3.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "6.7.0.0"
        },
        {
          "fixed": "6.7.3.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v6.7.0.0",
    "v6.7.0.1",
    "v6.7.1.0",
    "v6.7.1.1",
    "v6.7.1.2",
    "v6.7.2.0",
    "v6.7.2.1",
    "v6.7.2.2",
    "v6.7.3.0"
  ]
}

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.6.10.7

Fixed in 6.6.10.7

155 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.10.0, 6.4.10.1, 6.4.11.0, 6.4.11.1, 6.4.12.0, 6.4.13.0, 6.4.14.0, 6.4.15.0, 6.4.15.1, 6.4.15.2, 6.4.16.0, 6.4.16.1, 6.4.17.0, 6.4.17.1, 6.4.17.2, 6.4.18.0, 6.4.18.1, 6.4.19.0, 6.4.2.0, 6.4.2.1, 6.4.20.0, 6.4.20.1, 6.4.20.2, 6.4.3.0, 6.4.3.1, 6.4.4.0, 6.4.4.1, 6.4.5.0, 6.4.5.1, 6.4.6.0, 6.4.6.1, 6.4.7.0, 6.4.8.0, 6.4.8.1, 6.4.8.2, 6.4.9.0, 6.5.0.0, 6.5.0.0-rc1, 6.5.0.0-rc2, 6.5.0.0-rc3, 6.5.0.0-rc4, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3, v6.5.1.0, v6.5.1.1, v6.5.2.0, v6.5.2.1, v6.5.3.0, v6.5.3.1, v6.5.3.2, v6.5.3.3, v6.5.4.0, v6.5.4.1, v6.5.5.0, v6.5.5.1, v6.5.5.2, v6.5.6.0, v6.5.6.1, v6.5.7.0, v6.5.7.1, v6.5.7.2, v6.5.7.3, v6.5.7.4, v6.5.8.0, v6.5.8.1, v6.5.8.10, v6.5.8.11, v6.5.8.12, v6.5.8.13, v6.5.8.14, v6.5.8.15, v6.5.8.16, v6.5.8.17, v6.5.8.18, v6.5.8.19, v6.5.8.2, v6.5.8.3, v6.5.8.4, v6.5.8.5, v6.5.8.6, v6.5.8.7, v6.5.8.8, v6.5.8.9, v6.6.0.0, v6.6.0.0-rc1, v6.6.0.0-rc2, v6.6.0.0-rc3, v6.6.0.0-rc4, v6.6.0.0-rc5, v6.6.0.0-rc6, v6.6.0.0-rc7, v6.6.0.1, v6.6.0.2, v6.6.0.3, v6.6.1.0, v6.6.1.1, v6.6.1.2, v6.6.10.0, v6.6.10.1, v6.6.10.2, v6.6.10.3, v6.6.10.4, v6.6.10.5, v6.6.10.6, v6.6.2.0, v6.6.3.0, v6.6.3.1, v6.6.4.0, v6.6.4.1, v6.6.5.0, v6.6.5.1, v6.6.6.0, v6.6.6.1, v6.6.7.0, v6.6.7.1, v6.6.8.0, v6.6.8.1, v6.6.8.2, v6.6.9.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.6.10.7"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "6.4.1.1",
    "6.4.1.2",
    "6.4.10.0",
    "6.4.10.1",
    "6.4.11.0",
    "6.4.11.1",
    "6.4.12.0",
    "6.4.13.0",
    "6.4.14.0",
    "6.4.15.0",
    "6.4.15.1",
    "6.4.15.2",
    "6.4.16.0",
    "6.4.16.1",
    "6.4.17.0",
    "6.4.17.1",
    "6.4.17.2",
    "6.4.18.0",
    "6.4.18.1",
    "6.4.19.0",
    "6.4.2.0",
    "6.4.2.1",
    "6.4.20.0",
    "6.4.20.1",
    "6.4.20.2",
    "6.4.3.0",
    "6.4.3.1",
    "6.4.4.0",
    "6.4.4.1",
    "6.4.5.0",
    "6.4.5.1",
    "6.4.6.0",
    "6.4.6.1",
    "6.4.7.0",
    "6.4.8.0",
    "6.4.8.1",
    "6.4.8.2",
    "6.4.9.0",
    "6.5.0.0",
    "6.5.0.0-rc1",
    "6.5.0.0-rc2",
    "6.5.0.0-rc3",
    "6.5.0.0-rc4",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3",
    "v6.5.1.0",
    "v6.5.1.1",
    "v6.5.2.0",
    "v6.5.2.1",
    "v6.5.3.0",
    "v6.5.3.1",
    "v6.5.3.2",
    "v6.5.3.3",
    "v6.5.4.0",
    "v6.5.4.1",
    "v6.5.5.0",
    "v6.5.5.1",
    "v6.5.5.2",
    "v6.5.6.0",
    "v6.5.6.1",
    "v6.5.7.0",
    "v6.5.7.1",
    "v6.5.7.2",
    "v6.5.7.3",
    "v6.5.7.4",
    "v6.5.8.0",
    "v6.5.8.1",
    "v6.5.8.10",
    "v6.5.8.11",
    "v6.5.8.12",
    "v6.5.8.13",
    "v6.5.8.14",
    "v6.5.8.15",
    "v6.5.8.16",
    "v6.5.8.17",
    "v6.5.8.18",
    "v6.5.8.19",
    "v6.5.8.2",
    "v6.5.8.3",
    "v6.5.8.4",
    "v6.5.8.5",
    "v6.5.8.6",
    "v6.5.8.7",
    "v6.5.8.8",
    "v6.5.8.9",
    "v6.6.0.0",
    "v6.6.0.0-rc1",
    "v6.6.0.0-rc2",
    "v6.6.0.0-rc3",
    "v6.6.0.0-rc4",
    "v6.6.0.0-rc5",
    "v6.6.0.0-rc6",
    "v6.6.0.0-rc7",
    "v6.6.0.1",
    "v6.6.0.2",
    "v6.6.0.3",
    "v6.6.1.0",
    "v6.6.1.1",
    "v6.6.1.2",
    "v6.6.10.0",
    "v6.6.10.1",
    "v6.6.10.2",
    "v6.6.10.3",
    "v6.6.10.4",
    "v6.6.10.5",
    "v6.6.10.6",
    "v6.6.2.0",
    "v6.6.3.0",
    "v6.6.3.1",
    "v6.6.4.0",
    "v6.6.4.1",
    "v6.6.5.0",
    "v6.6.5.1",
    "v6.6.6.0",
    "v6.6.6.1",
    "v6.6.7.0",
    "v6.6.7.1",
    "v6.6.8.0",
    "v6.6.8.1",
    "v6.6.8.2",
    "v6.6.9.0"
  ]
}

high7.3

GHSA-8g35-7rmw-7f59Fix available

Shopware Vulnerable to Blind SQL-injection in DAL aggregations

Packagist / shopware/core Packagist / shopware/platform

08 Apr

shopware/core Packagist

Ecosystem versions

From 6.7.0.0-rc1 before 6.7.0.0-rc2

Fixed in 6.7.0.0-rc2

2 explicitly affected versions

6.7.0.0-rc1, v6.7.0.0-rc1

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "6.7.0.0-rc1"
        },
        {
          "fixed": "6.7.0.0-rc2"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.7.0.0-rc1",
    "v6.7.0.0-rc1"
  ]
}

shopware/core Packagist

Ecosystem versions

From 6.6.0.0 before 6.6.10.3

Fixed in 6.6.10.3

25 explicitly affected versions

v6.6.0.0, v6.6.0.1, v6.6.0.2, v6.6.0.3, v6.6.1.0, v6.6.1.1, v6.6.1.2, v6.6.10.0, v6.6.10.1, v6.6.10.2, v6.6.2.0, v6.6.3.0, v6.6.3.1, v6.6.4.0, v6.6.4.1, v6.6.5.0, v6.6.5.1, v6.6.6.0, v6.6.6.1, v6.6.7.0, v6.6.7.1, v6.6.8.0, v6.6.8.1, v6.6.8.2, v6.6.9.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "6.6.0.0"
        },
        {
          "fixed": "6.6.10.3"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v6.6.0.0",
    "v6.6.0.1",
    "v6.6.0.2",
    "v6.6.0.3",
    "v6.6.1.0",
    "v6.6.1.1",
    "v6.6.1.2",
    "v6.6.10.0",
    "v6.6.10.1",
    "v6.6.10.2",
    "v6.6.2.0",
    "v6.6.3.0",
    "v6.6.3.1",
    "v6.6.4.0",
    "v6.6.4.1",
    "v6.6.5.0",
    "v6.6.5.1",
    "v6.6.6.0",
    "v6.6.6.1",
    "v6.6.7.0",
    "v6.6.7.1",
    "v6.6.8.0",
    "v6.6.8.1",
    "v6.6.8.2",
    "v6.6.9.0"
  ]
}

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.5.8.18

Fixed in 6.5.8.18

117 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.10.0, 6.4.10.1, 6.4.11.0, 6.4.11.1, 6.4.12.0, 6.4.13.0, 6.4.14.0, 6.4.15.0, 6.4.15.1, 6.4.15.2, 6.4.16.0, 6.4.16.1, 6.4.17.0, 6.4.17.1, 6.4.17.2, 6.4.18.0, 6.4.18.1, 6.4.19.0, 6.4.2.0, 6.4.2.1, 6.4.20.0, 6.4.20.1, 6.4.20.2, 6.4.3.0, 6.4.3.1, 6.4.4.0, 6.4.4.1, 6.4.5.0, 6.4.5.1, 6.4.6.0, 6.4.6.1, 6.4.7.0, 6.4.8.0, 6.4.8.1, 6.4.8.2, 6.4.9.0, 6.5.0.0, 6.5.0.0-rc1, 6.5.0.0-rc2, 6.5.0.0-rc3, 6.5.0.0-rc4, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3, v6.5.1.0, v6.5.1.1, v6.5.2.0, v6.5.2.1, v6.5.3.0, v6.5.3.1, v6.5.3.2, v6.5.3.3, v6.5.4.0, v6.5.4.1, v6.5.5.0, v6.5.5.1, v6.5.5.2, v6.5.6.0, v6.5.6.1, v6.5.7.0, v6.5.7.1, v6.5.7.2, v6.5.7.3, v6.5.7.4, v6.5.8.0, v6.5.8.1, v6.5.8.10, v6.5.8.11, v6.5.8.12, v6.5.8.13, v6.5.8.14, v6.5.8.15, v6.5.8.16, v6.5.8.17, v6.5.8.2, v6.5.8.3, v6.5.8.4, v6.5.8.5, v6.5.8.6, v6.5.8.7, v6.5.8.8, v6.5.8.9

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.5.8.18"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "6.4.1.1",
    "6.4.1.2",
    "6.4.10.0",
    "6.4.10.1",
    "6.4.11.0",
    "6.4.11.1",
    "6.4.12.0",
    "6.4.13.0",
    "6.4.14.0",
    "6.4.15.0",
    "6.4.15.1",
    "6.4.15.2",
    "6.4.16.0",
    "6.4.16.1",
    "6.4.17.0",
    "6.4.17.1",
    "6.4.17.2",
    "6.4.18.0",
    "6.4.18.1",
    "6.4.19.0",
    "6.4.2.0",
    "6.4.2.1",
    "6.4.20.0",
    "6.4.20.1",
    "6.4.20.2",
    "6.4.3.0",
    "6.4.3.1",
    "6.4.4.0",
    "6.4.4.1",
    "6.4.5.0",
    "6.4.5.1",
    "6.4.6.0",
    "6.4.6.1",
    "6.4.7.0",
    "6.4.8.0",
    "6.4.8.1",
    "6.4.8.2",
    "6.4.9.0",
    "6.5.0.0",
    "6.5.0.0-rc1",
    "6.5.0.0-rc2",
    "6.5.0.0-rc3",
    "6.5.0.0-rc4",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3",
    "v6.5.1.0",
    "v6.5.1.1",
    "v6.5.2.0",
    "v6.5.2.1",
    "v6.5.3.0",
    "v6.5.3.1",
    "v6.5.3.2",
    "v6.5.3.3",
    "v6.5.4.0",
    "v6.5.4.1",
    "v6.5.5.0",
    "v6.5.5.1",
    "v6.5.5.2",
    "v6.5.6.0",
    "v6.5.6.1",
    "v6.5.7.0",
    "v6.5.7.1",
    "v6.5.7.2",
    "v6.5.7.3",
    "v6.5.7.4",
    "v6.5.8.0",
    "v6.5.8.1",
    "v6.5.8.10",
    "v6.5.8.11",
    "v6.5.8.12",
    "v6.5.8.13",
    "v6.5.8.14",
    "v6.5.8.15",
    "v6.5.8.16",
    "v6.5.8.17",
    "v6.5.8.2",
    "v6.5.8.3",
    "v6.5.8.4",
    "v6.5.8.5",
    "v6.5.8.6",
    "v6.5.8.7",
    "v6.5.8.8",
    "v6.5.8.9"
  ]
}

high7.5

GHSA-cgfj-hj93-rmh2Fix available

Shopware allows Denial Of Service via password length

Packagist / shopware/core Packagist / shopware/platform

08 Apr

shopware/core Packagist

Ecosystem versions

From 6.6.0.0 before 6.6.10.3

Fixed in 6.6.10.3

25 explicitly affected versions

v6.6.0.0, v6.6.0.1, v6.6.0.2, v6.6.0.3, v6.6.1.0, v6.6.1.1, v6.6.1.2, v6.6.10.0, v6.6.10.1, v6.6.10.2, v6.6.2.0, v6.6.3.0, v6.6.3.1, v6.6.4.0, v6.6.4.1, v6.6.5.0, v6.6.5.1, v6.6.6.0, v6.6.6.1, v6.6.7.0, v6.6.7.1, v6.6.8.0, v6.6.8.1, v6.6.8.2, v6.6.9.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "6.6.0.0"
        },
        {
          "fixed": "6.6.10.3"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v6.6.0.0",
    "v6.6.0.1",
    "v6.6.0.2",
    "v6.6.0.3",
    "v6.6.1.0",
    "v6.6.1.1",
    "v6.6.1.2",
    "v6.6.10.0",
    "v6.6.10.1",
    "v6.6.10.2",
    "v6.6.2.0",
    "v6.6.3.0",
    "v6.6.3.1",
    "v6.6.4.0",
    "v6.6.4.1",
    "v6.6.5.0",
    "v6.6.5.1",
    "v6.6.6.0",
    "v6.6.6.1",
    "v6.6.7.0",
    "v6.6.7.1",
    "v6.6.8.0",
    "v6.6.8.1",
    "v6.6.8.2",
    "v6.6.9.0"
  ]
}

shopware/core Packagist

Ecosystem versions

From 6.7.0.0-rc1 before 6.7.0.0-rc2

Fixed in 6.7.0.0-rc2

1 explicitly affected versions

v6.7.0.0-rc1

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "6.7.0.0-rc1"
        },
        {
          "fixed": "6.7.0.0-rc2"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v6.7.0.0-rc1"
  ]
}

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.5.8.17

Fixed in 6.5.8.17

116 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.10.0, 6.4.10.1, 6.4.11.0, 6.4.11.1, 6.4.12.0, 6.4.13.0, 6.4.14.0, 6.4.15.0, 6.4.15.1, 6.4.15.2, 6.4.16.0, 6.4.16.1, 6.4.17.0, 6.4.17.1, 6.4.17.2, 6.4.18.0, 6.4.18.1, 6.4.19.0, 6.4.2.0, 6.4.2.1, 6.4.20.0, 6.4.20.1, 6.4.20.2, 6.4.3.0, 6.4.3.1, 6.4.4.0, 6.4.4.1, 6.4.5.0, 6.4.5.1, 6.4.6.0, 6.4.6.1, 6.4.7.0, 6.4.8.0, 6.4.8.1, 6.4.8.2, 6.4.9.0, 6.5.0.0, 6.5.0.0-rc1, 6.5.0.0-rc2, 6.5.0.0-rc3, 6.5.0.0-rc4, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3, v6.5.1.0, v6.5.1.1, v6.5.2.0, v6.5.2.1, v6.5.3.0, v6.5.3.1, v6.5.3.2, v6.5.3.3, v6.5.4.0, v6.5.4.1, v6.5.5.0, v6.5.5.1, v6.5.5.2, v6.5.6.0, v6.5.6.1, v6.5.7.0, v6.5.7.1, v6.5.7.2, v6.5.7.3, v6.5.7.4, v6.5.8.0, v6.5.8.1, v6.5.8.10, v6.5.8.11, v6.5.8.12, v6.5.8.13, v6.5.8.14, v6.5.8.15, v6.5.8.16, v6.5.8.2, v6.5.8.3, v6.5.8.4, v6.5.8.5, v6.5.8.6, v6.5.8.7, v6.5.8.8, v6.5.8.9

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.5.8.17"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "6.4.1.1",
    "6.4.1.2",
    "6.4.10.0",
    "6.4.10.1",
    "6.4.11.0",
    "6.4.11.1",
    "6.4.12.0",
    "6.4.13.0",
    "6.4.14.0",
    "6.4.15.0",
    "6.4.15.1",
    "6.4.15.2",
    "6.4.16.0",
    "6.4.16.1",
    "6.4.17.0",
    "6.4.17.1",
    "6.4.17.2",
    "6.4.18.0",
    "6.4.18.1",
    "6.4.19.0",
    "6.4.2.0",
    "6.4.2.1",
    "6.4.20.0",
    "6.4.20.1",
    "6.4.20.2",
    "6.4.3.0",
    "6.4.3.1",
    "6.4.4.0",
    "6.4.4.1",
    "6.4.5.0",
    "6.4.5.1",
    "6.4.6.0",
    "6.4.6.1",
    "6.4.7.0",
    "6.4.8.0",
    "6.4.8.1",
    "6.4.8.2",
    "6.4.9.0",
    "6.5.0.0",
    "6.5.0.0-rc1",
    "6.5.0.0-rc2",
    "6.5.0.0-rc3",
    "6.5.0.0-rc4",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3",
    "v6.5.1.0",
    "v6.5.1.1",
    "v6.5.2.0",
    "v6.5.2.1",
    "v6.5.3.0",
    "v6.5.3.1",
    "v6.5.3.2",
    "v6.5.3.3",
    "v6.5.4.0",
    "v6.5.4.1",
    "v6.5.5.0",
    "v6.5.5.1",
    "v6.5.5.2",
    "v6.5.6.0",
    "v6.5.6.1",
    "v6.5.7.0",
    "v6.5.7.1",
    "v6.5.7.2",
    "v6.5.7.3",
    "v6.5.7.4",
    "v6.5.8.0",
    "v6.5.8.1",
    "v6.5.8.10",
    "v6.5.8.11",
    "v6.5.8.12",
    "v6.5.8.13",
    "v6.5.8.14",
    "v6.5.8.15",
    "v6.5.8.16",
    "v6.5.8.2",
    "v6.5.8.3",
    "v6.5.8.4",
    "v6.5.8.5",
    "v6.5.8.6",
    "v6.5.8.7",
    "v6.5.8.8",
    "v6.5.8.9"
  ]
}

high8.3

GHSA-35jp-8cgg-p4wjFix available

Shopware vulnerable to Server Side Template Injection in Twig using Context functions

Packagist / shopware/core Packagist / shopware/platform

08 Aug

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.5.8.13

Fixed in 6.5.8.13

112 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.10.0, 6.4.10.1, 6.4.11.0, 6.4.11.1, 6.4.12.0, 6.4.13.0, 6.4.14.0, 6.4.15.0, 6.4.15.1, 6.4.15.2, 6.4.16.0, 6.4.16.1, 6.4.17.0, 6.4.17.1, 6.4.17.2, 6.4.18.0, 6.4.18.1, 6.4.19.0, 6.4.2.0, 6.4.2.1, 6.4.20.0, 6.4.20.1, 6.4.20.2, 6.4.3.0, 6.4.3.1, 6.4.4.0, 6.4.4.1, 6.4.5.0, 6.4.5.1, 6.4.6.0, 6.4.6.1, 6.4.7.0, 6.4.8.0, 6.4.8.1, 6.4.8.2, 6.4.9.0, 6.5.0.0, 6.5.0.0-rc1, 6.5.0.0-rc2, 6.5.0.0-rc3, 6.5.0.0-rc4, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3, v6.5.1.0, v6.5.1.1, v6.5.2.0, v6.5.2.1, v6.5.3.0, v6.5.3.1, v6.5.3.2, v6.5.3.3, v6.5.4.0, v6.5.4.1, v6.5.5.0, v6.5.5.1, v6.5.5.2, v6.5.6.0, v6.5.6.1, v6.5.7.0, v6.5.7.1, v6.5.7.2, v6.5.7.3, v6.5.7.4, v6.5.8.0, v6.5.8.1, v6.5.8.10, v6.5.8.11, v6.5.8.12, v6.5.8.2, v6.5.8.3, v6.5.8.4, v6.5.8.5, v6.5.8.6, v6.5.8.7, v6.5.8.8, v6.5.8.9

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.5.8.13"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "6.4.1.1",
    "6.4.1.2",
    "6.4.10.0",
    "6.4.10.1",
    "6.4.11.0",
    "6.4.11.1",
    "6.4.12.0",
    "6.4.13.0",
    "6.4.14.0",
    "6.4.15.0",
    "6.4.15.1",
    "6.4.15.2",
    "6.4.16.0",
    "6.4.16.1",
    "6.4.17.0",
    "6.4.17.1",
    "6.4.17.2",
    "6.4.18.0",
    "6.4.18.1",
    "6.4.19.0",
    "6.4.2.0",
    "6.4.2.1",
    "6.4.20.0",
    "6.4.20.1",
    "6.4.20.2",
    "6.4.3.0",
    "6.4.3.1",
    "6.4.4.0",
    "6.4.4.1",
    "6.4.5.0",
    "6.4.5.1",
    "6.4.6.0",
    "6.4.6.1",
    "6.4.7.0",
    "6.4.8.0",
    "6.4.8.1",
    "6.4.8.2",
    "6.4.9.0",
    "6.5.0.0",
    "6.5.0.0-rc1",
    "6.5.0.0-rc2",
    "6.5.0.0-rc3",
    "6.5.0.0-rc4",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3",
    "v6.5.1.0",
    "v6.5.1.1",
    "v6.5.2.0",
    "v6.5.2.1",
    "v6.5.3.0",
    "v6.5.3.1",
    "v6.5.3.2",
    "v6.5.3.3",
    "v6.5.4.0",
    "v6.5.4.1",
    "v6.5.5.0",
    "v6.5.5.1",
    "v6.5.5.2",
    "v6.5.6.0",
    "v6.5.6.1",
    "v6.5.7.0",
    "v6.5.7.1",
    "v6.5.7.2",
    "v6.5.7.3",
    "v6.5.7.4",
    "v6.5.8.0",
    "v6.5.8.1",
    "v6.5.8.10",
    "v6.5.8.11",
    "v6.5.8.12",
    "v6.5.8.2",
    "v6.5.8.3",
    "v6.5.8.4",
    "v6.5.8.5",
    "v6.5.8.6",
    "v6.5.8.7",
    "v6.5.8.8",
    "v6.5.8.9"
  ]
}

shopware/core Packagist

Ecosystem versions

From 6.6.0.0 before 6.6.5.1

Fixed in 6.6.5.1

13 explicitly affected versions

v6.6.0.0, v6.6.0.1, v6.6.0.2, v6.6.0.3, v6.6.1.0, v6.6.1.1, v6.6.1.2, v6.6.2.0, v6.6.3.0, v6.6.3.1, v6.6.4.0, v6.6.4.1, v6.6.5.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "6.6.0.0"
        },
        {
          "fixed": "6.6.5.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v6.6.0.0",
    "v6.6.0.1",
    "v6.6.0.2",
    "v6.6.0.3",
    "v6.6.1.0",
    "v6.6.1.1",
    "v6.6.1.2",
    "v6.6.2.0",
    "v6.6.3.0",
    "v6.6.3.1",
    "v6.6.4.0",
    "v6.6.4.1",
    "v6.6.5.0"
  ]
}

high8.3

GHSA-27wp-jvhw-v4xpFix available

Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag

Packagist / shopware/core Packagist / shopware/platform

08 Aug

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.5.8.13

Fixed in 6.5.8.13

112 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.10.0, 6.4.10.1, 6.4.11.0, 6.4.11.1, 6.4.12.0, 6.4.13.0, 6.4.14.0, 6.4.15.0, 6.4.15.1, 6.4.15.2, 6.4.16.0, 6.4.16.1, 6.4.17.0, 6.4.17.1, 6.4.17.2, 6.4.18.0, 6.4.18.1, 6.4.19.0, 6.4.2.0, 6.4.2.1, 6.4.20.0, 6.4.20.1, 6.4.20.2, 6.4.3.0, 6.4.3.1, 6.4.4.0, 6.4.4.1, 6.4.5.0, 6.4.5.1, 6.4.6.0, 6.4.6.1, 6.4.7.0, 6.4.8.0, 6.4.8.1, 6.4.8.2, 6.4.9.0, 6.5.0.0, 6.5.0.0-rc1, 6.5.0.0-rc2, 6.5.0.0-rc3, 6.5.0.0-rc4, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3, v6.5.1.0, v6.5.1.1, v6.5.2.0, v6.5.2.1, v6.5.3.0, v6.5.3.1, v6.5.3.2, v6.5.3.3, v6.5.4.0, v6.5.4.1, v6.5.5.0, v6.5.5.1, v6.5.5.2, v6.5.6.0, v6.5.6.1, v6.5.7.0, v6.5.7.1, v6.5.7.2, v6.5.7.3, v6.5.7.4, v6.5.8.0, v6.5.8.1, v6.5.8.10, v6.5.8.11, v6.5.8.12, v6.5.8.2, v6.5.8.3, v6.5.8.4, v6.5.8.5, v6.5.8.6, v6.5.8.7, v6.5.8.8, v6.5.8.9

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.5.8.13"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "6.4.1.1",
    "6.4.1.2",
    "6.4.10.0",
    "6.4.10.1",
    "6.4.11.0",
    "6.4.11.1",
    "6.4.12.0",
    "6.4.13.0",
    "6.4.14.0",
    "6.4.15.0",
    "6.4.15.1",
    "6.4.15.2",
    "6.4.16.0",
    "6.4.16.1",
    "6.4.17.0",
    "6.4.17.1",
    "6.4.17.2",
    "6.4.18.0",
    "6.4.18.1",
    "6.4.19.0",
    "6.4.2.0",
    "6.4.2.1",
    "6.4.20.0",
    "6.4.20.1",
    "6.4.20.2",
    "6.4.3.0",
    "6.4.3.1",
    "6.4.4.0",
    "6.4.4.1",
    "6.4.5.0",
    "6.4.5.1",
    "6.4.6.0",
    "6.4.6.1",
    "6.4.7.0",
    "6.4.8.0",
    "6.4.8.1",
    "6.4.8.2",
    "6.4.9.0",
    "6.5.0.0",
    "6.5.0.0-rc1",
    "6.5.0.0-rc2",
    "6.5.0.0-rc3",
    "6.5.0.0-rc4",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3",
    "v6.5.1.0",
    "v6.5.1.1",
    "v6.5.2.0",
    "v6.5.2.1",
    "v6.5.3.0",
    "v6.5.3.1",
    "v6.5.3.2",
    "v6.5.3.3",
    "v6.5.4.0",
    "v6.5.4.1",
    "v6.5.5.0",
    "v6.5.5.1",
    "v6.5.5.2",
    "v6.5.6.0",
    "v6.5.6.1",
    "v6.5.7.0",
    "v6.5.7.1",
    "v6.5.7.2",
    "v6.5.7.3",
    "v6.5.7.4",
    "v6.5.8.0",
    "v6.5.8.1",
    "v6.5.8.10",
    "v6.5.8.11",
    "v6.5.8.12",
    "v6.5.8.2",
    "v6.5.8.3",
    "v6.5.8.4",
    "v6.5.8.5",
    "v6.5.8.6",
    "v6.5.8.7",
    "v6.5.8.8",
    "v6.5.8.9"
  ]
}

shopware/core Packagist

Ecosystem versions

From 6.6.0.0 before 6.6.5.1

Fixed in 6.6.5.1

13 explicitly affected versions

v6.6.0.0, v6.6.0.1, v6.6.0.2, v6.6.0.3, v6.6.1.0, v6.6.1.1, v6.6.1.2, v6.6.2.0, v6.6.3.0, v6.6.3.1, v6.6.4.0, v6.6.4.1, v6.6.5.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "6.6.0.0"
        },
        {
          "fixed": "6.6.5.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v6.6.0.0",
    "v6.6.0.1",
    "v6.6.0.2",
    "v6.6.0.3",
    "v6.6.1.0",
    "v6.6.1.1",
    "v6.6.1.2",
    "v6.6.2.0",
    "v6.6.3.0",
    "v6.6.3.1",
    "v6.6.4.0",
    "v6.6.4.1",
    "v6.6.5.0"
  ]
}

medium5.3

GHSA-5297-wrrp-rcj7Fix available

Shopware Improper Session Handling in store-api account logout

Packagist / shopware/core Packagist / shopware/platform

08 Apr

shopware/core Packagist

Ecosystem versions

From 6.3.5.0 before 6.5.8.8

Fixed in 6.5.8.8

79 explicitly affected versions

6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.10.0, 6.4.10.1, 6.4.11.0, 6.4.11.1, 6.4.12.0, 6.4.13.0, 6.4.14.0, 6.4.15.0, 6.4.15.1, 6.4.15.2, 6.4.16.0, 6.4.16.1, 6.4.17.0, 6.4.17.1, 6.4.17.2, 6.4.18.0, 6.4.18.1, 6.4.19.0, 6.4.2.0, 6.4.2.1, 6.4.20.0, 6.4.20.1, 6.4.20.2, 6.4.3.0, 6.4.3.1, 6.4.4.0, 6.4.4.1, 6.4.5.0, 6.4.5.1, 6.4.6.0, 6.4.6.1, 6.4.7.0, 6.4.8.0, 6.4.8.1, 6.4.8.2, 6.4.9.0, 6.5.0.0, 6.5.0.0-rc1, 6.5.0.0-rc2, 6.5.0.0-rc3, 6.5.0.0-rc4, v6.5.1.0, v6.5.1.1, v6.5.2.0, v6.5.2.1, v6.5.3.0, v6.5.3.1, v6.5.3.2, v6.5.3.3, v6.5.4.0, v6.5.4.1, v6.5.5.0, v6.5.5.1, v6.5.5.2, v6.5.6.0, v6.5.6.1, v6.5.7.0, v6.5.7.1, v6.5.7.2, v6.5.7.3, v6.5.7.4, v6.5.8.0, v6.5.8.1, v6.5.8.2, v6.5.8.3, v6.5.8.4, v6.5.8.5, v6.5.8.6, v6.5.8.7

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "6.3.5.0"
        },
        {
          "fixed": "6.5.8.8"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "6.4.1.1",
    "6.4.1.2",
    "6.4.10.0",
    "6.4.10.1",
    "6.4.11.0",
    "6.4.11.1",
    "6.4.12.0",
    "6.4.13.0",
    "6.4.14.0",
    "6.4.15.0",
    "6.4.15.1",
    "6.4.15.2",
    "6.4.16.0",
    "6.4.16.1",
    "6.4.17.0",
    "6.4.17.1",
    "6.4.17.2",
    "6.4.18.0",
    "6.4.18.1",
    "6.4.19.0",
    "6.4.2.0",
    "6.4.2.1",
    "6.4.20.0",
    "6.4.20.1",
    "6.4.20.2",
    "6.4.3.0",
    "6.4.3.1",
    "6.4.4.0",
    "6.4.4.1",
    "6.4.5.0",
    "6.4.5.1",
    "6.4.6.0",
    "6.4.6.1",
    "6.4.7.0",
    "6.4.8.0",
    "6.4.8.1",
    "6.4.8.2",
    "6.4.9.0",
    "6.5.0.0",
    "6.5.0.0-rc1",
    "6.5.0.0-rc2",
    "6.5.0.0-rc3",
    "6.5.0.0-rc4",
    "v6.5.1.0",
    "v6.5.1.1",
    "v6.5.2.0",
    "v6.5.2.1",
    "v6.5.3.0",
    "v6.5.3.1",
    "v6.5.3.2",
    "v6.5.3.3",
    "v6.5.4.0",
    "v6.5.4.1",
    "v6.5.5.0",
    "v6.5.5.1",
    "v6.5.5.2",
    "v6.5.6.0",
    "v6.5.6.1",
    "v6.5.7.0",
    "v6.5.7.1",
    "v6.5.7.2",
    "v6.5.7.3",
    "v6.5.7.4",
    "v6.5.8.0",
    "v6.5.8.1",
    "v6.5.8.2",
    "v6.5.8.3",
    "v6.5.8.4",
    "v6.5.8.5",
    "v6.5.8.6",
    "v6.5.8.7"
  ]
}

shopware/core Packagist

Ecosystem versions

From 6.6.0.0-rc1 before 6.6.1.0

Fixed in 6.6.1.0

11 explicitly affected versions

v6.6.0.0, v6.6.0.0-rc1, v6.6.0.0-rc2, v6.6.0.0-rc3, v6.6.0.0-rc4, v6.6.0.0-rc5, v6.6.0.0-rc6, v6.6.0.0-rc7, v6.6.0.1, v6.6.0.2, v6.6.0.3

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "6.6.0.0-rc1"
        },
        {
          "fixed": "6.6.1.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v6.6.0.0",
    "v6.6.0.0-rc1",
    "v6.6.0.0-rc2",
    "v6.6.0.0-rc3",
    "v6.6.0.0-rc4",
    "v6.6.0.0-rc5",
    "v6.6.0.0-rc6",
    "v6.6.0.0-rc7",
    "v6.6.0.1",
    "v6.6.0.2",
    "v6.6.0.3"
  ]
}

medium4.9

GHSA-3867-jc5c-66qfFix available

Broken Access Control order API in Shopware

Packagist / shopware/core Packagist / shopware/platform

17 Jan

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.5.7.4

Fixed in 6.5.7.4

98 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.10.0, 6.4.10.1, 6.4.11.0, 6.4.11.1, 6.4.12.0, 6.4.13.0, 6.4.14.0, 6.4.15.0, 6.4.15.1, 6.4.15.2, 6.4.16.0, 6.4.16.1, 6.4.17.0, 6.4.17.1, 6.4.17.2, 6.4.18.0, 6.4.18.1, 6.4.19.0, 6.4.2.0, 6.4.2.1, 6.4.20.0, 6.4.20.1, 6.4.20.2, 6.4.3.0, 6.4.3.1, 6.4.4.0, 6.4.4.1, 6.4.5.0, 6.4.5.1, 6.4.6.0, 6.4.6.1, 6.4.7.0, 6.4.8.0, 6.4.8.1, 6.4.8.2, 6.4.9.0, 6.5.0.0, 6.5.0.0-rc1, 6.5.0.0-rc2, 6.5.0.0-rc3, 6.5.0.0-rc4, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3, v6.5.1.0, v6.5.1.1, v6.5.2.0, v6.5.2.1, v6.5.3.0, v6.5.3.1, v6.5.3.2, v6.5.3.3, v6.5.4.0, v6.5.4.1, v6.5.5.0, v6.5.5.1, v6.5.5.2, v6.5.6.0, v6.5.6.1, v6.5.7.0, v6.5.7.1, v6.5.7.2, v6.5.7.3

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.5.7.4"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "6.4.1.1",
    "6.4.1.2",
    "6.4.10.0",
    "6.4.10.1",
    "6.4.11.0",
    "6.4.11.1",
    "6.4.12.0",
    "6.4.13.0",
    "6.4.14.0",
    "6.4.15.0",
    "6.4.15.1",
    "6.4.15.2",
    "6.4.16.0",
    "6.4.16.1",
    "6.4.17.0",
    "6.4.17.1",
    "6.4.17.2",
    "6.4.18.0",
    "6.4.18.1",
    "6.4.19.0",
    "6.4.2.0",
    "6.4.2.1",
    "6.4.20.0",
    "6.4.20.1",
    "6.4.20.2",
    "6.4.3.0",
    "6.4.3.1",
    "6.4.4.0",
    "6.4.4.1",
    "6.4.5.0",
    "6.4.5.1",
    "6.4.6.0",
    "6.4.6.1",
    "6.4.7.0",
    "6.4.8.0",
    "6.4.8.1",
    "6.4.8.2",
    "6.4.9.0",
    "6.5.0.0",
    "6.5.0.0-rc1",
    "6.5.0.0-rc2",
    "6.5.0.0-rc3",
    "6.5.0.0-rc4",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3",
    "v6.5.1.0",
    "v6.5.1.1",
    "v6.5.2.0",
    "v6.5.2.1",
    "v6.5.3.0",
    "v6.5.3.1",
    "v6.5.3.2",
    "v6.5.3.3",
    "v6.5.4.0",
    "v6.5.4.1",
    "v6.5.5.0",
    "v6.5.5.1",
    "v6.5.5.2",
    "v6.5.6.0",
    "v6.5.6.1",
    "v6.5.7.0",
    "v6.5.7.1",
    "v6.5.7.2",
    "v6.5.7.3"
  ]
}

medium4.3

GHSA-46h7-vj7x-fxg2Fix available

Shopware has Improper Input Validation issue in newsletter subscription

Packagist / shopware/platform Packagist / shopware/core

20 Jan

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.4.18.1

Fixed in 6.4.18.1

69 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.10.0, 6.4.10.1, 6.4.11.0, 6.4.11.1, 6.4.12.0, 6.4.13.0, 6.4.14.0, 6.4.15.0, 6.4.15.1, 6.4.15.2, 6.4.16.0, 6.4.16.1, 6.4.17.0, 6.4.17.1, 6.4.17.2, 6.4.18.0, 6.4.2.0, 6.4.2.1, 6.4.3.0, 6.4.3.1, 6.4.4.0, 6.4.4.1, 6.4.5.0, 6.4.5.1, 6.4.6.0, 6.4.6.1, 6.4.7.0, 6.4.8.0, 6.4.8.1, 6.4.8.2, 6.4.9.0, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.4.18.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "6.4.1.1",
    "6.4.1.2",
    "6.4.10.0",
    "6.4.10.1",
    "6.4.11.0",
    "6.4.11.1",
    "6.4.12.0",
    "6.4.13.0",
    "6.4.14.0",
    "6.4.15.0",
    "6.4.15.1",
    "6.4.15.2",
    "6.4.16.0",
    "6.4.16.1",
    "6.4.17.0",
    "6.4.17.1",
    "6.4.17.2",
    "6.4.18.0",
    "6.4.2.0",
    "6.4.2.1",
    "6.4.3.0",
    "6.4.3.1",
    "6.4.4.0",
    "6.4.4.1",
    "6.4.5.0",
    "6.4.5.1",
    "6.4.6.0",
    "6.4.6.1",
    "6.4.7.0",
    "6.4.8.0",
    "6.4.8.1",
    "6.4.8.2",
    "6.4.9.0",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3"
  ]
}

critical9.8

GHSA-93cw-f5jj-x85wFix available

Shopware vulnerable to Improper Control of Generation of Code in Twig rendered views

Packagist / shopware/platform Packagist / shopware/core

17 Jan

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.4.18.1

Fixed in 6.4.18.1

69 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.10.0, 6.4.10.1, 6.4.11.0, 6.4.11.1, 6.4.12.0, 6.4.13.0, 6.4.14.0, 6.4.15.0, 6.4.15.1, 6.4.15.2, 6.4.16.0, 6.4.16.1, 6.4.17.0, 6.4.17.1, 6.4.17.2, 6.4.18.0, 6.4.2.0, 6.4.2.1, 6.4.3.0, 6.4.3.1, 6.4.4.0, 6.4.4.1, 6.4.5.0, 6.4.5.1, 6.4.6.0, 6.4.6.1, 6.4.7.0, 6.4.8.0, 6.4.8.1, 6.4.8.2, 6.4.9.0, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.4.18.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "6.4.1.1",
    "6.4.1.2",
    "6.4.10.0",
    "6.4.10.1",
    "6.4.11.0",
    "6.4.11.1",
    "6.4.12.0",
    "6.4.13.0",
    "6.4.14.0",
    "6.4.15.0",
    "6.4.15.1",
    "6.4.15.2",
    "6.4.16.0",
    "6.4.16.1",
    "6.4.17.0",
    "6.4.17.1",
    "6.4.17.2",
    "6.4.18.0",
    "6.4.2.0",
    "6.4.2.1",
    "6.4.3.0",
    "6.4.3.1",
    "6.4.4.0",
    "6.4.4.1",
    "6.4.5.0",
    "6.4.5.1",
    "6.4.6.0",
    "6.4.6.1",
    "6.4.7.0",
    "6.4.8.0",
    "6.4.8.1",
    "6.4.8.2",
    "6.4.9.0",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3"
  ]
}

high7.5

GHSA-r4ph-mx67-x58pFix available

Shopware database password is leaked to an unauthenticated users

Packagist / shopware/core Packagist / shopware/platform

24 May

shopware/core Packagist

Ecosystem versions

From 6.0.0 before 6.2.3

Fixed in 6.2.3

15 explicitly affected versions

v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "6.0.0"
        },
        {
          "fixed": "6.2.3"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2"
  ]
}

high8.1

GHSA-9wrv-g75h-8cccFix available

Improper Access Control in Shopware

Packagist / shopware/platform Packagist / shopware/core

22 Apr

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.4.10.1

Fixed in 6.4.10.1

54 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.10.0, 6.4.2.0, 6.4.2.1, 6.4.3.0, 6.4.3.1, 6.4.4.0, 6.4.4.1, 6.4.5.0, 6.4.5.1, 6.4.6.0, 6.4.6.1, 6.4.7.0, 6.4.8.0, 6.4.8.1, 6.4.8.2, 6.4.9.0, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.4.10.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "6.4.1.1",
    "6.4.1.2",
    "6.4.10.0",
    "6.4.2.0",
    "6.4.2.1",
    "6.4.3.0",
    "6.4.3.1",
    "6.4.4.0",
    "6.4.4.1",
    "6.4.5.0",
    "6.4.5.1",
    "6.4.6.0",
    "6.4.6.1",
    "6.4.7.0",
    "6.4.8.0",
    "6.4.8.1",
    "6.4.8.2",
    "6.4.9.0",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3"
  ]
}

medium6.8

GHSA-83vp-6jqg-6cmrFix available

Incorrect Authentication in shopware

Packagist / shopware/core

10 Mar

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.4.8.2

Fixed in 6.4.8.2

51 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.2.0, 6.4.2.1, 6.4.3.0, 6.4.3.1, 6.4.4.0, 6.4.4.1, 6.4.5.0, 6.4.5.1, 6.4.6.0, 6.4.6.1, 6.4.7.0, 6.4.8.0, 6.4.8.1, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.4.8.2"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "6.4.1.1",
    "6.4.1.2",
    "6.4.2.0",
    "6.4.2.1",
    "6.4.3.0",
    "6.4.3.1",
    "6.4.4.0",
    "6.4.4.1",
    "6.4.5.0",
    "6.4.5.1",
    "6.4.6.0",
    "6.4.6.1",
    "6.4.7.0",
    "6.4.8.0",
    "6.4.8.1",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3"
  ]
}

low2.6

GHSA-w267-m9c4-8555Fix available

Shopware user session is not logged out if the password is reset via password recovery

Packagist / shopware/platform Packagist / shopware/core

10 Mar

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.4.8.1

Fixed in 6.4.8.1

50 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.2.0, 6.4.2.1, 6.4.3.0, 6.4.3.1, 6.4.4.0, 6.4.4.1, 6.4.5.0, 6.4.5.1, 6.4.6.0, 6.4.6.1, 6.4.7.0, 6.4.8.0, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.4.8.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "6.4.1.1",
    "6.4.1.2",
    "6.4.2.0",
    "6.4.2.1",
    "6.4.3.0",
    "6.4.3.1",
    "6.4.4.0",
    "6.4.4.1",
    "6.4.5.0",
    "6.4.5.1",
    "6.4.6.0",
    "6.4.6.1",
    "6.4.7.0",
    "6.4.8.0",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3"
  ]
}

medium6.5

GHSA-54gp-qff8-946cFix available

Insecure direct object reference of log files of the Import/Export feature

Packagist / shopware/platform Packagist / shopware/core

30 Aug

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.4.3.1

Fixed in 6.4.3.1

41 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.2.0, 6.4.2.1, 6.4.3.0, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.4.3.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "6.4.1.1",
    "6.4.1.2",
    "6.4.2.0",
    "6.4.2.1",
    "6.4.3.0",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3"
  ]
}

medium6.5

GHSA-9f8f-574q-8jmfFix available

Manipulation of product reviews via API

Packagist / shopware/platform Packagist / shopware/core

30 Aug

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.4.3.1

Fixed in 6.4.3.1

41 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.2.0, 6.4.2.1, 6.4.3.0, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.4.3.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "6.4.1.1",
    "6.4.1.2",
    "6.4.2.0",
    "6.4.2.1",
    "6.4.3.0",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3"
  ]
}

high8.0

GHSA-fc38-mxwr-pfhxFix available

Cross-Site Scripting via SVG media files

Packagist / shopware/core Packagist / shopware/platform

23 Aug

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.4.3.1

Fixed in 6.4.3.1

41 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.2.0, 6.4.2.1, 6.4.3.0, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.4.3.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "6.4.1.1",
    "6.4.1.2",
    "6.4.2.0",
    "6.4.2.1",
    "6.4.3.0",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3"
  ]
}

high8.8

GHSA-gcvv-gq92-x94rFix available

Authenticated server-side request forgery in file upload via URL.

Packagist / shopware/platform Packagist / shopware/core

23 Aug

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.4.3.1

Fixed in 6.4.3.1

41 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.2.0, 6.4.2.1, 6.4.3.0, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.4.3.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "6.4.1.1",
    "6.4.1.2",
    "6.4.2.0",
    "6.4.2.1",
    "6.4.3.0",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3"
  ]
}

medium

GHSA-243q-g9j3-qf6rNo CVE assignedFix available

non-admin users can create integration role with administrator role

Packagist / shopware/platform Packagist / shopware/core

28 Jun

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.4.1.1

Fixed in 6.4.1.1

36 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.4.1.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3"
  ]
}

high7.5

GHSA-vrf2-xghr-j52vFix available

Exposure of Sensitive Information to an Unauthorized Actor

Packagist / shopware/platform Packagist / shopware/core

28 Jun

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.4.1.1

Fixed in 6.4.1.1

36 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.4.1.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3"
  ]
}

low

GHSA-g7w8-pp9w-7p32Fix available

Creation of order credits was not validated by acl in admin orders

Packagist / shopware/platform Packagist / shopware/core

28 Jun

shopware/core Packagist

Ecosystem versions

Earlier releases before 6.4.1.1

Fixed in 6.4.1.1

36 explicitly affected versions

6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "6.4.1.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "6.3.0.0",
    "6.3.0.1",
    "6.3.0.2",
    "6.3.1.0",
    "6.3.1.1",
    "6.3.2.0",
    "6.3.2.1",
    "6.3.3.0",
    "6.3.3.1",
    "6.3.4.0",
    "6.3.4.1",
    "6.3.5.0",
    "6.3.5.1",
    "6.3.5.2",
    "6.3.5.3",
    "6.3.5.4",
    "6.4.0.0",
    "6.4.0.0-RC1",
    "6.4.1.0",
    "v6.0.0+ea2",
    "v6.1.0",
    "v6.1.0-rc1",
    "v6.1.0-rc2",
    "v6.1.0-rc3",
    "v6.1.0-rc4",
    "v6.1.1",
    "v6.1.2",
    "v6.1.3",
    "v6.1.4",
    "v6.1.5",
    "v6.1.6",
    "v6.2.0",
    "v6.2.0-RC1",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3"
  ]
}

Set up in your agent.

shopware/core

Check the version you ship.

Advisories & recorded fixes

Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation

Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment

Shopware: Admin API ACL Bypass in Order State Transition Endpoints

Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames

Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts

Shopware Has Improper Control of Generation of Code in Twig rendered views

Shopware 6's password recovery link does not expire after email change

Shopware Customer Orders can be canceled, even if refunds are disabled

Shopware exposes sensitive user information via CSV export mapping

Shopware vulnerable to path traversal via Plugin upload

Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually

Shopware Vulnerable to Blind SQL-injection in DAL aggregations

Shopware allows Denial Of Service via password length

Shopware vulnerable to Server Side Template Injection in Twig using Context functions

Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag

Shopware Improper Session Handling in store-api account logout

Broken Access Control order API in Shopware

Shopware has Improper Input Validation issue in newsletter subscription

Shopware vulnerable to Improper Control of Generation of Code in Twig rendered views

Shopware database password is leaked to an unauthenticated users

Improper Access Control in Shopware

Incorrect Authentication in shopware

Shopware user session is not logged out if the password is reset via password recovery

Insecure direct object reference of log files of the Import/Export feature

Manipulation of product reviews via API

Cross-Site Scripting via SVG media files

Authenticated server-side request forgery in file upload via URL.

non-admin users can create integration role with administrator role

Exposure of Sensitive Information to an Unauthorized Actor

Creation of order credits was not validated by acl in admin orders