Описание
Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature. This allows an authenticated user to send HTTP, HTTPS, FTP, and SFTP requests on behalf of the Shopware platform server.
Ссылки
- Vendor Advisory
- Release NotesVendor Advisory
- Vendor Advisory
- Release NotesVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 6.2.3 (исключая)
cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*
EPSS
Процентиль: 57%
0.00357
Низкий
8.8 High
CVSS3
6.5 Medium
CVSS2
Дефекты
CWE-918
Связанные уязвимости
EPSS
Процентиль: 57%
0.00357
Низкий
8.8 High
CVSS3
6.5 Medium
CVSS2
Дефекты
CWE-918