CVE-2020-13997

Shopware version 6.2.2 and earlier are vulnerable to an information disclosure issue involving the database password. The vulnerability is triggered when a DriverException (likely related to the database connection) occurs and verbose error handling is enabled on the server. Under these conditions, the full database connection string, including the password, is included in the error output sent back to the user, without requiring authentication [1][2].

The attack surface is exposed to any unauthenticated user who can trigger a database-level error. This could be achieved by sending a malformed request or exploiting another condition that leads to a DriverException. No special privileges or network position is required beyond basic access to the Shopware instance. The vulnerability is directly exploitable over HTTP.

Successful exploitation allows an unauthenticated attacker to obtain the database credentials. With these credentials, the attacker could gain full access to the Shopware database, potentially reading, modifying, or deleting sensitive data such as customer information, orders, and product data [2].

The issue has been addressed in Shopware version 6.2.3. Users are strongly advised to upgrade to this version or later. Additionally, disabling verbose error handling in production environments would prevent the password from being leaked even if a similar error occurs [1].