Packagist (Composer) package
shopware/platform
pkg:composer/shopware/platform
Vulnerabilities (42)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2020-13971 | — | < 6.2.3 | 6.2.3 | Jul 28, 2020 | In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication. | ||
| CVE-2020-13997 | — | >= 6.0.0, < 6.2.3 | 6.2.3 | Jul 28, 2020 | In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled. |
- CVE-2020-13971Jul 28, 2020affected < 6.2.3fixed 6.2.3
In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication.
- CVE-2020-13997Jul 28, 2020affected >= 6.0.0, < 6.2.3fixed 6.2.3
In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled.
Page 3 of 3