GHSA-qvc5-cfrr-384v RCE in Third Party Library in Shopware
Remote code execution vulnerability in a third-party library used by Shopware allows attackers to execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not stated
- Fix
- Available
What is GHSA-qvc5-cfrr-384v?
GHSA-qvc5-cfrr-384v is a code injection vulnerability in shopware/core, published on 23 Sep 2020. It can be exploited over the network.
Official description
Impact
RCE in Third Party Library
Patches
We recommend to update to the current version 6.3.1.1. You can get the update to 6.3.1.1 regularly via the Auto-Updater or directly via the download overview.
For older versions you can use the Security Plugin: https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
References
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-09-2020
Which versions are affected by GHSA-qvc5-cfrr-384v?
4 open source packages ship an affected version, including shopware/core and shopware/platform.
| Package | Affected | Fixed in |
|---|---|---|
shopware/core Packagist | All versions | 6.3.1.1 |
shopware/core Packagist | All versions | 6.3.1.1 |
shopware/platform Packagist | All versions | 6.3.1.1 |
shopware/platform Packagist | All versions | 6.3.1.1 |
How do I fix GHSA-qvc5-cfrr-384v?
Upgrade shopware/core to 6.3.1.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is GHSA-qvc5-cfrr-384v being exploited?
There is no known exploitation of GHSA-qvc5-cfrr-384v in the wild and no public exploit code.