CVE-2021-32717
Description
Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL is known. Users are recommend to first change their configuration to set the correct visibility according to the documentation. The visibility must be at the same level as `type`. When the Storage is saved on Amazon AWS we recommending disabling public access to the bucket containing the private files: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html. Otherwise, update to Shopware 6.4.1.1 or install or update the Security plugin (https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659) and run the command `./bin/console s3:set-visibility` to correct your cloud file visibilities.
How to fix
- shopware shopware6.4.1.1 or later
- shopware/platform6.4.1.1 or later
- shopware/core6.4.1.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| shopware shopware | 6.1.0 ≤ v < 6.4.1.1 | 6.4.1.1 |
| shopware/platformPackagist | v < 6.4.1.1 | 6.4.1.1 |
| shopware/corePackagist | v < 6.4.1.1 | 6.4.1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.