CVE-2020-13971

2020-07-2821:15:14

Google

osv.dev

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.7%

JSON

In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication.

CPENameOperatorVersion
platformeq6.1.0-rc1
platformeq6.1.0-rc2
platformeq6.1.0-rc4
platformeq6.0.0+ea1.1
platformeq6.2.1
platformeq6.1.5
platformeq6.1.0-rc3
platformeq6.1.4
platformeq6.0.0+ea1
platformeq6.0.0+dp1

Name	Operator	Version
platform	eq	6.1.0-rc1
platform	eq	6.1.0-rc2
platform	eq	6.1.0-rc4
platform	eq	6.0.0+ea1.1
platform	eq	6.2.1
platform	eq	6.1.5
platform	eq	6.1.0-rc3
platform	eq	6.1.4
platform	eq	6.0.0+ea1
platform	eq	6.0.0+dp1