GHSA-wq3r-jwrq-xg6w Canceling of orders not related to the logged-in user
Authenticated users can cancel orders belonging to other users due to missing authorization checks in Shopware.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-wq3r-jwrq-xg6w?
GHSA-wq3r-jwrq-xg6w is a missing authorization vulnerability in shopware/core, published on 28 Jun 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Impact
Canceling of orders not related to the logged-in user
Patches
We recommend updating to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/download/#shopware-6
Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Which versions are affected by GHSA-wq3r-jwrq-xg6w?
4 open source packages ship an affected version, including shopware/core and shopware/platform.
| Package | Affected | Fixed in |
|---|---|---|
shopware/core Packagist | All versions | 6.4.1.1 |
shopware/core Packagist | All versions | 6.4.1.1 |
shopware/platform Packagist | All versions | 6.4.1.1 |
shopware/platform Packagist | All versions | 6.4.1.1 |
How do I fix GHSA-wq3r-jwrq-xg6w?
Upgrade shopware/core to 6.4.1.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is GHSA-wq3r-jwrq-xg6w being exploited?
There is no known exploitation of GHSA-wq3r-jwrq-xg6w in the wild and no public exploit code.