CVE-2020-13970 Shopware vulnerable to SSRF
Authenticated users can exploit SSRF in the Mediabrowser upload feature to send arbitrary network requests from the server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-13970?
CVE-2020-13970 is a high-severity server-side request forgery vulnerability in Shopware Shopware, published on 28 Jul 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature. This allows an authenticated user to send HTTP, HTTPS, FTP, and SFTP requests on behalf of the Shopware platform server.
Weakness: CWE-918
Which versions are affected by CVE-2020-13970?
2 open source packages ship an affected version, including shopware/platform. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
shopware/platform Packagist | All versions | 6.2.3 |
shopware/platform Packagist | All versions | 6.2.3 |
Products include Shopware Shopware.
How do I fix CVE-2020-13970?
Upgrade shopware/platform to 6.2.3 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2020-13970 being exploited?
There is no known exploitation of CVE-2020-13970 in the wild and no public exploit code.
Other vulnerabilities in Shopware Shopware
- CVE-2023-22731 Improper Control of Generation of Code in Twig rendered views in shopware
- CVE-2016-3109 Shopware RCE Vulnerability
- CVE-2024-22406 Blind SQL-injection in DAL aggregations in Shopware
- CVE-2021-32711 Leak of information via Store-API
- CVE-2026-31887 Shopware unauthenticated data extraction possible through store-api.order endpoint
Sources
Also known as GHSA-5vmg-x99g-396q.