shopware/core (Packagist)
Advisories
96
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 6.7.10.1 or later clears every advisory below that has a fix.
Upgrade commands
composer
composer require shopware/core:^6.7.10.1Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-gq96-5pfx-f4vc Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation |
Medium EPSS 0.37% |
>= 6.7.0.0, < 6.7.10.1 | 6.7.10.1 |
| GHSA-xvhc-gm7j-mhmc Shopware: Stored XSS via SVG file upload — no SVG sanitization |
Medium EPSS 0.48% |
>= 6.7.0.0, < 6.7.10.1 | 6.7.10.1 |
| GHSA-xvhc-gm7j-mhmc Shopware: Stored XSS via SVG file upload — no SVG sanitization |
Medium EPSS 0.48% |
< 6.6.10.18 | 6.6.10.18 |
| GHSA-9v5m-39wh-5chq Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment |
Medium EPSS 0.41% |
< 6.6.10.18 | 6.6.10.18 |
| GHSA-9v5m-39wh-5chq Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment |
Medium EPSS 0.41% |
>= 6.7.0.0, < 6.7.10.1 | 6.7.10.1 |
| GHSA-f8q6-3g5w-jjr6 Shopware: Admin API ACL Bypass in Order State Transition Endpoints |
Medium EPSS 0.39% |
< 6.6.10.18 | 6.6.10.18 |
| GHSA-f8q6-3g5w-jjr6 Shopware: Admin API ACL Bypass in Order State Transition Endpoints |
Medium EPSS 0.39% |
>= 6.7.0.0, < 6.7.10.1 | 6.7.10.1 |
| GHSA-4x3x-869w-xx3m Shopware SSO referer trust leading to an arbitrary redirect target |
Medium EPSS 0.27% |
>= 6.7.3.0, < 6.7.10.1 | 6.7.10.1 |
| GHSA-7w52-7jvm-m9vw Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames |
Low EPSS 0.22% |
< 6.6.10.18 | 6.6.10.18 |
| GHSA-7w52-7jvm-m9vw Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames |
Low EPSS 0.22% |
>= 6.7.0.0, < 6.7.10.1 | 6.7.10.1 |
| GHSA-v39m-97p8-gqg7 Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts |
Medium EPSS 0.47% |
< 6.6.10.18 | 6.6.10.18 |
| GHSA-v39m-97p8-gqg7 Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts |
Medium EPSS 0.47% |
>= 6.7.0.0, < 6.7.10.1 | 6.7.10.1 |
| GHSA-8v9p-g828-v98f Shopware: Admin Account Takeover via User Recovery Hash Exposure |
Medium EPSS 0.46% |
< 6.6.10.18 | 6.6.10.18 |
| GHSA-8v9p-g828-v98f Shopware: Admin Account Takeover via User Recovery Hash Exposure |
Medium EPSS 0.46% |
>= 6.7.0.0, < 6.7.10.1 | 6.7.10.1 |
| GHSA-gv8p-48fr-4fxg Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass |
Medium EPSS 0.47% |
< 6.6.10.18 | 6.6.10.18 |
| GHSA-gv8p-48fr-4fxg Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass |
Medium EPSS 0.47% |
>= 6.7.0.0, < 6.7.10.1 | 6.7.10.1 |
| GHSA-c4p7-rwrg-pf6p Shopware vulnerable to a potential take over of app credentials |
High EPSS 0.28% |
>= 6.7.0.0, < 6.7.8.1 | 6.7.8.1 |
| GHSA-c4p7-rwrg-pf6p Shopware vulnerable to a potential take over of app credentials |
High EPSS 0.28% |
< 6.6.10.15 | 6.6.10.15 |
| GHSA-gqc5-xv7m-gcjq Shopware has user enumeration via distinct error codes on Store API login endpoint |
Medium EPSS 0.23% |
>= 6.7.0.0, < 6.7.8.1 | 6.7.8.1 |
| GHSA-gqc5-xv7m-gcjq Shopware has user enumeration via distinct error codes on Store API login endpoint |
Medium EPSS 0.23% |
< 6.6.10.15 | 6.6.10.15 |
| GHSA-7vvp-j573-5584 Shopware: Unauthenticated data extraction possible through store-api.order endpoint |
High EPSS 0.25% |
< 6.6.10.15 | 6.6.10.15 |
| GHSA-7vvp-j573-5584 Shopware: Unauthenticated data extraction possible through store-api.order endpoint |
High EPSS 0.25% |
>= 6.7.0.0, < 6.7.8.1 | 6.7.8.1 |
| GHSA-7cw6-7h3h-v8pf Shopware Has Improper Control of Generation of Code in Twig rendered views |
High EPSS 0.44% |
>= 6.7.0.0, < 6.7.6.1 | 6.7.6.1 |
| GHSA-2w46-vq8h-98vh Shopware 6's password recovery link does not expire after email change |
Medium | < 6.6.10.9 | 6.6.10.9 |
| GHSA-2w46-vq8h-98vh Shopware 6's password recovery link does not expire after email change |
Medium | >= 6.7.0.0, < 6.7.4.1 | 6.7.4.1 |
| GHSA-r2vg-hvjm-fg38 Shopware Customer Orders can be canceled, even if refunds are disabled |
Medium | < 6.6.10.7 | 6.6.10.7 |
| GHSA-r2vg-hvjm-fg38 Shopware Customer Orders can be canceled, even if refunds are disabled |
Medium | >= 6.7.0.0, < 6.7.3.1 | 6.7.3.1 |
| GHSA-27c9-vp3w-6ww8 Shopware exposes sensitive user information via CSV export mapping |
Medium | >= 6.7.0.0, < 6.7.3.1 | 6.7.3.1 |
| GHSA-27c9-vp3w-6ww8 Shopware exposes sensitive user information via CSV export mapping |
Medium | < 6.6.10.7 | 6.6.10.7 |
| GHSA-3cpp-fv95-mpr5 Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice |
Low | >= 6.7.0.0, < 6.7.3.1 | 6.7.3.1 |
| GHSA-3cpp-fv95-mpr5 Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice |
Low | < 6.6.10.7 | 6.6.10.7 |
| GHSA-6wh5-mw9h-5c3w Shopware vulnerable to path traversal via Plugin upload |
Low | < 6.6.10.7 | 6.6.10.7 |
| GHSA-6wh5-mw9h-5c3w Shopware vulnerable to path traversal via Plugin upload |
Low | >= 6.7.0.0, < 6.7.3.1 | 6.7.3.1 |
| GHSA-m895-2hj3-8cg9 Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually |
Medium | < 6.6.10.7 | 6.6.10.7 |
| GHSA-m895-2hj3-8cg9 Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually |
Medium | >= 6.7.0.0, < 6.7.3.1 | 6.7.3.1 |
| GHSA-9v82-vcjx-m76j Shopware: Reflective Cross Site-Scripting (XSS) in CMS components |
High | >= 6.7.0.0, < 6.7.2.1 | 6.7.2.1 |
| GHSA-4h9w-7vfp-px8m Shopware default newsletter opt-in settings allow for mass sign-up abuse |
Medium EPSS 0.31% |
>= 6.6.0.0-rc1, < 6.6.10.3 | 6.6.10.3 |
| GHSA-4h9w-7vfp-px8m Shopware default newsletter opt-in settings allow for mass sign-up abuse |
Medium EPSS 0.31% |
>= 6.7.0.0-rc1, < 6.7.0.0-rc2 | 6.7.0.0-rc2 |
| GHSA-4h9w-7vfp-px8m Shopware default newsletter opt-in settings allow for mass sign-up abuse |
Medium EPSS 0.31% |
< 6.5.8.17 | 6.5.8.17 |
| GHSA-68wv-g3fw-pq7q Shopware Broken ACL on Document retrieval to access other customers documents |
Medium | < 6.5.8.17 | 6.5.8.17 |
| GHSA-68wv-g3fw-pq7q Shopware Broken ACL on Document retrieval to access other customers documents |
Medium | >= 6.6.0.0, < 6.6.10.3 | 6.6.10.3 |
| GHSA-68wv-g3fw-pq7q Shopware Broken ACL on Document retrieval to access other customers documents |
Medium | >= 6.7.0.0-rc1, < 6.7.0.0-rc2 | 6.7.0.0-rc2 |
| GHSA-8g35-7rmw-7f59 Shopware Vulnerable to Blind SQL-injection in DAL aggregations |
Medium EPSS 12.93% |
>= 6.7.0.0-rc1, < 6.7.0.0-rc2 | 6.7.0.0-rc2 |
| GHSA-8g35-7rmw-7f59 Shopware Vulnerable to Blind SQL-injection in DAL aggregations |
Medium EPSS 12.93% |
>= 6.6.0.0, < 6.6.10.3 | 6.6.10.3 |
| GHSA-8g35-7rmw-7f59 Shopware Vulnerable to Blind SQL-injection in DAL aggregations |
Medium EPSS 12.93% |
< 6.5.8.18 | 6.5.8.18 |
| GHSA-cgfj-hj93-rmh2 Shopware allows Denial Of Service via password length |
High EPSS 0.42% |
>= 6.7.0.0-rc1, < 6.7.0.0-rc2 | 6.7.0.0-rc2 |
| GHSA-cgfj-hj93-rmh2 Shopware allows Denial Of Service via password length |
High EPSS 0.42% |
< 6.5.8.17 | 6.5.8.17 |
| GHSA-cgfj-hj93-rmh2 Shopware allows Denial Of Service via password length |
High EPSS 0.42% |
>= 6.6.0.0, < 6.6.10.3 | 6.6.10.3 |
| GHSA-hh7j-6x3q-f52h Shopware 6 allows attackers to check for registered accounts through the store-api |
Medium EPSS 0.40% |
< 6.5.8.18 | 6.5.8.18 |
| GHSA-hh7j-6x3q-f52h Shopware 6 allows attackers to check for registered accounts through the store-api |
Medium EPSS 0.40% |
>= 6.6.0.0, < 6.6.10.3 | 6.6.10.3 |
| GHSA-hh7j-6x3q-f52h Shopware 6 allows attackers to check for registered accounts through the store-api |
Medium EPSS 0.40% |
>= 6.7.0.0-rc1, < 6.7.0.0-rc2 | 6.7.0.0-rc2 |
| GHSA-p6w9-r443-r752 Shopware vulnerable to blind SQL-injection in DAL aggregations |
Critical EPSS 0.60% |
>= 6.6.0.0, < 6.6.5.1 | 6.6.5.1 |
| GHSA-p6w9-r443-r752 Shopware vulnerable to blind SQL-injection in DAL aggregations |
Critical EPSS 0.60% |
< 6.5.8.13 | 6.5.8.13 |
| GHSA-35jp-8cgg-p4wj Shopware vulnerable to Server Side Template Injection in Twig using Context functions |
High EPSS 0.65% |
< 6.5.8.13 | 6.5.8.13 |
| GHSA-35jp-8cgg-p4wj Shopware vulnerable to Server Side Template Injection in Twig using Context functions |
High EPSS 0.65% |
>= 6.6.0.0, < 6.6.5.1 | 6.6.5.1 |
| GHSA-27wp-jvhw-v4xp Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag |
Critical EPSS 0.86% |
>= 6.6.0.0, < 6.6.5.1 | 6.6.5.1 |
| GHSA-27wp-jvhw-v4xp Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag |
Critical EPSS 0.86% |
< 6.5.8.13 | 6.5.8.13 |
| GHSA-hhcq-ph6w-494g Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api |
Medium EPSS 0.43% |
>= 6.6.0.0, < 6.6.5.1 | 6.6.5.1 |
| GHSA-hhcq-ph6w-494g Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api |
Medium EPSS 0.43% |
< 6.5.8.13 | 6.5.8.13 |
| GHSA-5297-wrrp-rcj7 Shopware Improper Session Handling in store-api account logout |
Medium EPSS 0.50% |
>= 6.3.5.0, < 6.5.8.8 | 6.5.8.8 |
| GHSA-5297-wrrp-rcj7 Shopware Improper Session Handling in store-api account logout |
Medium EPSS 0.50% |
>= 6.6.0.0-rc1, < 6.6.1.0 | 6.6.1.0 |
| GHSA-3867-jc5c-66qf Broken Access Control order API in Shopware |
Medium EPSS 0.40% |
< 6.5.7.4 | 6.5.7.4 |
| GHSA-qmp9-2xwj-m6m9 Blind SQL injection in shopware |
Critical EPSS 0.64% |
< 6.5.7.4 | 6.5.7.4 |
| GHSA-7v2v-9rm4-7m8f Shopware Has Improper Control of Generation of Code in Twig rendered views |
High EPSS 2.07% |
< 6.4.20.1 | 6.4.20.1 |
| GHSA-46h7-vj7x-fxg2 Shopware has Improper Input Validation issue in newsletter subscription |
Medium EPSS 0.63% |
< 6.4.18.1 | 6.4.18.1 |
| GHSA-59qg-93jg-236f Shopware has Insufficient Session Expiration in Administration |
Low EPSS 0.76% |
< 6.4.18.1 | 6.4.18.1 |
| GHSA-7cp7-jfp6-jh4f Shopware's log module vulnerable to Improper Output Neutralization |
Low EPSS 0.74% |
< 6.4.18.1 | 6.4.18.1 |
| GHSA-93cw-f5jj-x85w Shopware vulnerable to Improper Control of Generation of Code in Twig rendered views |
Critical EPSS 1.39% |
< 6.4.18.1 | 6.4.18.1 |
| GHSA-8r6h-m72v-38fg Shopware vulnerable to Improper Input Validation of Clearance sale in cart |
Medium EPSS 0.69% |
< 6.4.18.1 | 6.4.18.1 |
| GHSA-r4ph-mx67-x58p Shopware database password is leaked to an unauthenticated users |
High EPSS 1.49% |
>= 6.0.0, < 6.2.3 | 6.2.3 |
| GHSA-9wrv-g75h-8ccc Improper Access Control in Shopware |
High EPSS 1.05% |
< 6.4.10.1 | 6.4.10.1 |
| GHSA-7gm7-8q8v-9gf2 Server-Side Request Forgery (SSRF) in Shopware |
High EPSS 1.06% |
< 6.4.10.1 | 6.4.10.1 |
| GHSA-83vp-6jqg-6cmr Incorrect Authentication in shopware |
Medium EPSS 0.76% |
< 6.4.8.2 | 6.4.8.2 |
| GHSA-6wrh-279j-6hvw HTTP caching is marking private HTTP headers as public in Shopware |
Medium EPSS 1.10% |
< 6.4.8.2 | 6.4.8.2 |
| GHSA-952p-fqcp-g8pc HTML injection possibility in voucher code form in Shopware |
Medium EPSS 0.84% |
< 6.4.8.1 | 6.4.8.1 |
| GHSA-w267-m9c4-8555 Shopware user session is not logged out if the password is reset via password recovery |
Low EPSS 0.48% |
< 6.4.8.1 | 6.4.8.1 |
| GHSA-r64m-qchj-hrjp Webcache Poisoning in shopware/platform and shopware/core |
Critical | < 6.4.6.1 | 6.4.6.1 |
| GHSA-54gp-qff8-946c Insecure direct object reference of log files of the Import/Export feature |
Medium EPSS 0.77% |
< 6.4.3.1 | 6.4.3.1 |
| GHSA-xh55-2fqp-p775 Command injection in mail agent settings |
High EPSS 2.36% |
< 6.4.3.1 | 6.4.3.1 |
| GHSA-9f8f-574q-8jmf Manipulation of product reviews via API |
Medium EPSS 0.89% |
< 6.4.3.1 | 6.4.3.1 |
| GHSA-fc38-mxwr-pfhx Cross-Site Scripting via SVG media files |
High EPSS 0.74% |
< 6.4.3.1 | 6.4.3.1 |
| GHSA-gcvv-gq92-x94r Authenticated server-side request forgery in file upload via URL. |
High EPSS 1.06% |
< 6.4.3.1 | 6.4.3.1 |
| GHSA-243q-g9j3-qf6r non-admin users can create integration role with administrator role |
Medium | < 6.4.1.1 | 6.4.1.1 |
| GHSA-68v9-3jjq-rvp4 Exposure of Sensitive Information to an Unauthorized Actor |
Medium EPSS 1.11% |
< 6.4.1.1 | 6.4.1.1 |
| GHSA-6gr8-c3m5-mvrg Exposure of Sensitive Information to an Unauthorized Actor |
High EPSS 1.46% |
< 6.4.1.1 | 6.4.1.1 |
| GHSA-g7w8-pp9w-7p32 Creation of order credits was not validated by acl in admin orders |
Medium EPSS 0.63% |
< 6.4.1.1 | 6.4.1.1 |
| GHSA-wq3r-jwrq-xg6w Canceling of orders not related to the logged-in user |
Medium | < 6.4.1.1 | 6.4.1.1 |
| GHSA-88rc-3p98-rgvx After order payment process manipulation in shopware/platform and shopware/core |
Critical | < 6.3.5.3 | 6.3.5.3 |
| GHSA-qg7c-q3vq-rgxr Leak of information via Store-API aggregations in shopware/platform and shopware/core |
Critical | < 6.3.5.3 | 6.3.5.3 |
| GHSA-8pfh-mm2g-hmc3 Authenticated Server Side Request Forgery |
Low | < 6.3.4.1 | 6.3.4.1 |
| GHSA-cq6h-w3mc-57f4 Information exposure via query strings in URL |
Low | < 6.3.4.1 | 6.3.4.1 |
| GHSA-5q58-x5h2-v5rx Authenticated Privilege Escalation |
Low | < 6.3.4.1 | 6.3.4.1 |
| GHSA-p68v-frgx-4rjp Denial of Service via Cache Flooding |
Low | < 6.3.2.1 | 6.3.2.1 |
| GHSA-8xv9-qcr9-ww9j Authenticated XML External Entity Processing |
Medium | < 6.3.2.1 | 6.3.2.1 |
| GHSA-qvhr-55hg-3qwv Non-persistent XSS in the Storefront in Shopware |
Low | < 6.3.1.1 | 6.3.1.1 |
| GHSA-qvc5-cfrr-384v RCE in Third Party Library in Shopware |
Low | < 6.3.1.1 | 6.3.1.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor