GHSA-28fw-88hq-6jmm Persistent XSS in shopping worlds
Attackers can inject persistent scripts into shopping worlds, potentially stealing user data or hijacking accounts; users should upgrade to the latest version.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-28fw-88hq-6jmm?
GHSA-28fw-88hq-6jmm is a cross-site scripting vulnerability in shopware/shopware, published on 13 Nov 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Impact
Persistent XSS in shopping worlds
Patches
We recommend updating to the current version 5.6.9. You can get the update to 5.6.9 regularly via the Auto-Updater or directly via the download overview.
For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html
References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-11-2020
Which versions are affected by GHSA-28fw-88hq-6jmm?
2 open source packages ship an affected version, including shopware/shopware.
| Package | Affected | Fixed in |
|---|---|---|
shopware/shopware Packagist | All versions | 5.6.9 |
shopware/shopware Packagist | All versions | 5.6.9 |
How do I fix GHSA-28fw-88hq-6jmm?
Upgrade shopware/shopware to 5.6.9 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-28fw-88hq-6jmm being exploited?
There is no known exploitation of GHSA-28fw-88hq-6jmm in the wild and no public exploit code.