Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2020-13970
8.8
HIGHCVSS v3
Published
July 28, 2020
CVSS v2
6.5 MEDIUM
Affected
3 projects
Assigned by
MITRE
Severity scale
010
Description
Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature. This allows an authenticated user to send HTTP, HTTPS, FTP, and SFTP requests on behalf of the Shopware platform server.
shopware/shopware
GitHubShopware 6 is an open commerce platform based on Symfony Framework and Vue and supported by a worldwide community and more than 3.100 community extensions
GitHubShopware 6 is an open commerce platform based on Symfony Framework and Vue and supported by a worldwide community and more than 3.100 community extensions< 6.2.3NVD
shopware/shopware
PackagistShopware 5 is an open source e-commerce software made in Germany
PackagistShopware 5 is an open source e-commerce software made in Germany< 6.2.3NVD