CVE-2021-37711

Опубликовано: 16 авг. 2021

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

Versions prior to 6.4.3.1 contain an authenticated server-side request forgery vulnerability in file upload via URL. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.

Ссылки

https://github.com/shopware/platform/commit/b9f330e652b743dd2374c02bbe68f28b59a3f502
Patch
Third Party Advisory
https://github.com/shopware/platform/security/advisories/GHSA-gcvv-gq92-x94r
Third Party Advisory
https://github.com/shopware/platform/commit/b9f330e652b743dd2374c02bbe68f28b59a3f502
Patch
Third Party Advisory
https://github.com/shopware/platform/security/advisories/GHSA-gcvv-gq92-x94r
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*

Версия от 6.1.0 (включая) до 6.4.3.1 (исключая)

EPSS

Процентиль: 66%

0.00519

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-918

Связанные уязвимости

GHSA-gcvv-gq92-x94r