GHSA-6gv9-7q4g-pmvm Persistent XSS in customer module in Shopware
Attackers can inject persistent scripts into the customer module, potentially stealing data or hijacking accounts; users should upgrade Shopware.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-6gv9-7q4g-pmvm?
GHSA-6gv9-7q4g-pmvm is a cross-site scripting vulnerability in shopware/shopware, published on 13 Nov 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Impact
Persistent XSS in customer module
Patches
We recommend updating to the current version 5.6.9. You can get the update to 5.6.9 regularly via the Auto-Updater or directly via the download overview.
For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html
References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-11-2020
Which versions are affected by GHSA-6gv9-7q4g-pmvm?
2 open source packages ship an affected version, including shopware/shopware.
| Package | Affected | Fixed in |
|---|---|---|
shopware/shopware Packagist | All versions | 5.6.9 |
shopware/shopware Packagist | All versions | 5.6.9 |
How do I fix GHSA-6gv9-7q4g-pmvm?
Upgrade shopware/shopware to 5.6.9 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-6gv9-7q4g-pmvm being exploited?
There is no known exploitation of GHSA-6gv9-7q4g-pmvm in the wild and no public exploit code.