Open-source package vulnerability · Composer (PHP)
GHSA-83jv-4prm-34g7: Shopware Remote Code Execution Vulnerability
criticalCVSS 3.1 9.8
Under certain circumstances it is possible to execute an authorized foreign code in Shopware version prior to 5.2.25.
Published May 21, 2024
Affected packages
shopware/shopware
- Ecosystem
- Composer (PHP)
- Affected
- >= 4.2.0, < 5.2.25
- Fixed in
- 5.2.25
- Check
composer show shopware/shopware
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Under certain circumstances it is possible to execute an authorized foreign code in Shopware version prior to 5.2.25.
References
- https://github.com/shopware5/shopware/commit/8f6a7cefcba7547276892b82f64e4874c1a0dfed
- https://community.shopware.com/_detail_2015.html
- https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2017?category=shopware-5-en/security-updates
- https://github.com/FriendsOfPHP/security-advisories/blob/master/shopware/shopware/2017-06-22.yaml
- https://github.com/advisories/GHSA-83jv-4prm-34g7
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology