GHSA-f6p7-8xfw-fjqq Authenticated Stored XSS in Administration
Authenticated users can inject malicious scripts into the administration panel, potentially leading to session hijacking or data manipulation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-f6p7-8xfw-fjqq?
GHSA-f6p7-8xfw-fjqq is a cross-site scripting vulnerability in shopware/shopware, published on 21 May 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Impact
Authenticated Stored XSS in Administration
Patches
We recommend updating to the current version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.
For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html
References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-05-2021
Which versions are affected by GHSA-f6p7-8xfw-fjqq?
2 open source packages ship an affected version, including shopware/shopware.
| Package | Affected | Fixed in |
|---|---|---|
shopware/shopware Packagist | All versions | 5.6.10 |
shopware/shopware Packagist | All versions | 5.6.10 |
How do I fix GHSA-f6p7-8xfw-fjqq?
Upgrade shopware/shopware to 5.6.10 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-f6p7-8xfw-fjqq being exploited?
There is no known exploitation of GHSA-f6p7-8xfw-fjqq in the wild and no public exploit code.