GHSA-qvhr-55hg-3qwv Non-persistent XSS in the Storefront in Shopware
Attackers can execute arbitrary scripts in the Shopware Storefront via non-persistent XSS, requiring user interaction to trigger.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-qvhr-55hg-3qwv?
GHSA-qvhr-55hg-3qwv is a cross-site scripting vulnerability in shopware/core, published on 23 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Impact
Non-persistent XSS in the Storefront
Patches
We recommend to update to the current version 6.3.1.1. You can get the update to 6.3.1.1 regularly via the Auto-Updater or directly via the download overview.
For older versions you can use the Security Plugin: https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
References
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-09-2020
Which versions are affected by GHSA-qvhr-55hg-3qwv?
4 open source packages ship an affected version, including shopware/core and shopware/platform.
| Package | Affected | Fixed in |
|---|---|---|
shopware/core Packagist | All versions | 6.3.1.1 |
shopware/core Packagist | All versions | 6.3.1.1 |
shopware/platform Packagist | All versions | 6.3.1.1 |
shopware/platform Packagist | All versions | 6.3.1.1 |
How do I fix GHSA-qvhr-55hg-3qwv?
Upgrade shopware/core to 6.3.1.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-qvhr-55hg-3qwv being exploited?
There is no known exploitation of GHSA-qvhr-55hg-3qwv in the wild and no public exploit code.