Vulnerabilities > CVE-2021-37710 - Unspecified vulnerability in Shopware
Attack vector
NETWORK Attack complexity
LOW Privileges required
LOW Confidentiality impact
LOW Integrity impact
LOW Availability impact
NONE Summary
Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a Cross-Site Scripting vulnerability via SVG media files. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.
Vulnerable Configurations
References
- https://github.com/shopware/platform/commit/abe9f69e1f667800f974acccd3047b4930e4b423
- https://github.com/shopware/platform/commit/abe9f69e1f667800f974acccd3047b4930e4b423
- https://github.com/shopware/platform/security/advisories/GHSA-fc38-mxwr-pfhx
- https://github.com/shopware/platform/security/advisories/GHSA-fc38-mxwr-pfhx