CVE Vulnerability

CVE-2021-32717

Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL is known. Users are recommend to first change their configuration to set the correct visibility according to the documentation. The visibility must be at the same level as `type`. When the Storage is saved on Amazon AWS we recommending disabling public access to the bucket containing the private files: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html. Otherwise, update to Shopware 6.4.1.1 or install or update the Security plugin (https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659) and run the command `./bin/console s3:set-visibility` to correct your cloud file visibilities.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-06-2021 Patch Vendor Advisory
https://github.com/shopware/platform/security/advisories/GHSA-vrf2-xghr-j52v Third Party Advisory
https://github.com/shopware/platform/commit/ba52f683372b8417a00e9014f481ed3d539f34b3 Patch Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*
Information

Published : 2021-06-24 09:15

Updated : 2022-10-25 02:39

NVD link : CVE-2021-32717

Mitre link : CVE-2021-32717

Products Affected
No products.
CWE
CWE-732