shopware/storefront (Packagist)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 6.7.5.1 or later clears every advisory below that has a fix.

Upgrade commands

composer

composer require shopware/storefront:^6.7.5.1

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GHSA-6w82-v552-wjw2 Shopware Storefront Reflected XSS in Storefront Login Page	Medium EPSS 0.19%	`>= 6.4.6.0, < 6.6.10.10`	`6.6.10.10`
GHSA-6w82-v552-wjw2 Shopware Storefront Reflected XSS in Storefront Login Page	Medium EPSS 0.19%	`>= 6.7.0.0, < 6.7.5.1`	`6.7.5.1`
GHSA-c2f9-4jmm-v45m Shopware's session is persistent in Cache for 404 pages	High EPSS 0.61%	`>= 6.5.8.0, < 6.5.8.7`	`6.5.8.7`
GHSA-6wrh-279j-6hvw HTTP caching is marking private HTTP headers as public in Shopware	Medium EPSS 1.10%	`< 6.4.8.2`	`6.4.8.2`
GHSA-952p-fqcp-g8pc HTML injection possibility in voucher code form in Shopware	Medium EPSS 0.84%	`< 6.4.8.1`	`6.4.8.1`
GHSA-jp6h-mxhx-pgqh Shopware guest session is shared between customers	Medium EPSS 0.53%	`< 6.4.8.2`	`6.4.8.2`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor