Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2020-13971
5.4
MEDIUMCVSS v3
Published
July 28, 2020
CVSS v2
3.5 LOW
Affected
3 projects
Assigned by
MITRE
Severity scale
010
Description
In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication.
shopware/shopware
GitHubShopware 6 is an open commerce platform based on Symfony Framework and Vue and supported by a worldwide community and more than 3.100 community extensions
GitHubShopware 6 is an open commerce platform based on Symfony Framework and Vue and supported by a worldwide community and more than 3.100 community extensions< 6.2.3NVD
shopware/shopware
PackagistShopware 5 is an open source e-commerce software made in Germany
PackagistShopware 5 is an open source e-commerce software made in Germany< 6.2.3NVD