Server-side Request Forgery (SSRF)

2022-04-2102:52:45

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

42.3%

JSON

shopware/platform is vulnerable to server-side request forgery. An attacker can read or update internal resources by sending malicious requests on behalf of the server into the admin SDK functionality.

CPENameOperatorVersion
shopware/platformle6.4.10.0
shopware/corele6.4.10.0
shopware/platformle6.4.10.0
shopware/corele6.4.10.0

Name	Operator	Version
shopware/platform	le	6.4.10.0
shopware/core	le	6.4.10.0
shopware/platform	le	6.4.10.0
shopware/core	le	6.4.10.0

References

docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022

github.com/shopware/core/commit/859711fc49e7ca79ac779e49b911b4902abffcea

github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77c

github.com/shopware/platform/security/advisories/GHSA-7gm7-8q8v-9gf2

0.001 Low

EPSS

Percentile

42.3%

JSON

Related for VERACODE:35185