GHSA-243q-g9j3-qf6r non-admin users can create integration role with administrator role
Non-admin users can escalate privileges by creating integration roles with administrator permissions, requiring an upgrade to the latest version.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-243q-g9j3-qf6r?
GHSA-243q-g9j3-qf6r is a vulnerability in shopware/core, published on 28 Jun 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Impact
non-admin users can create integration role with administrator role
Patches
We recommend updating to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/download/#shopware-6
Workarounds
For older versions of 6.1, 6.2, and 6.3 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Which versions are affected by GHSA-243q-g9j3-qf6r?
4 open source packages ship an affected version, including shopware/core and shopware/platform.
| Package | Affected | Fixed in |
|---|---|---|
shopware/core Packagist | All versions | 6.4.1.1 |
shopware/core Packagist | All versions | 6.4.1.1 |
shopware/platform Packagist | All versions | 6.4.1.1 |
shopware/platform Packagist | All versions | 6.4.1.1 |
How do I fix GHSA-243q-g9j3-qf6r?
Upgrade shopware/core to 6.4.1.1 or later.
Is GHSA-243q-g9j3-qf6r being exploited?
There is no known exploitation of GHSA-243q-g9j3-qf6r in the wild and no public exploit code.