GHSA-hrfh-fp4x-crrq Persistent XSS in newsletter module in Shopware
Attackers can inject persistent scripts into the newsletter module, potentially stealing user sessions or executing malicious code.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-hrfh-fp4x-crrq?
GHSA-hrfh-fp4x-crrq is a cross-site scripting vulnerability in shopware/shopware, published on 13 Nov 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Impact
Persistent XSS in newsletter module
Patches
We recommend updating to the current version 5.6.9. You can get the update to 5.6.9 regularly via the Auto-Updater or directly via the download overview.
For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html
References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-11-2020
Which versions are affected by GHSA-hrfh-fp4x-crrq?
2 open source packages ship an affected version, including shopware/shopware.
| Package | Affected | Fixed in |
|---|---|---|
shopware/shopware Packagist | All versions | 5.6.9 |
shopware/shopware Packagist | All versions | 5.6.9 |
How do I fix GHSA-hrfh-fp4x-crrq?
Upgrade shopware/shopware to 5.6.9 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-hrfh-fp4x-crrq being exploited?
There is no known exploitation of GHSA-hrfh-fp4x-crrq in the wild and no public exploit code.