CVE-2020-13971 Shopware vulnerable to Cross-site Scripting
Authenticated users can upload malicious SVG files leading to persistent XSS, allowing attackers to execute scripts in victim browsers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-13971?
CVE-2020-13971 is a medium-severity cross-site scripting vulnerability in Shopware Shopware, published on 28 Jul 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication.
Weakness: CWE-79
Which versions are affected by CVE-2020-13971?
2 open source packages ship an affected version, including shopware/platform. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
shopware/platform Packagist | All versions | 6.2.3 |
shopware/platform Packagist | All versions | 6.2.3 |
Products include Shopware Shopware.
How do I fix CVE-2020-13971?
Upgrade shopware/platform to 6.2.3 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-13971 being exploited?
There is no known exploitation of CVE-2020-13971 in the wild and no public exploit code.
Other vulnerabilities in Shopware Shopware
- CVE-2023-22731 Improper Control of Generation of Code in Twig rendered views in shopware
- CVE-2016-3109 Shopware RCE Vulnerability
- CVE-2024-22406 Blind SQL-injection in DAL aggregations in Shopware
- CVE-2021-32711 Leak of information via Store-API
- CVE-2026-31887 Shopware unauthenticated data extraction possible through store-api.order endpoint
Sources
Also known as GHSA-fxf3-wx3c-76pf.