GHSA-5vmg-x99g-396q
Suggest an improvement- Source
- https://github.com/advisories/GHSA-5vmg-x99g-396q
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-5vmg-x99g-396q/GHSA-5vmg-x99g-396q.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-5vmg-x99g-396q
- Aliases
- Published
- 2022-05-24T17:24:28Z
- Modified
- 2023-11-01T04:51:51.188597Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Shopware vulnerable to SSRF
- Details
-
Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature. This allows an authenticated user to send HTTP, HTTPS, FTP, and SFTP requests on behalf of the Shopware platform server.
- Database specific
{ "nvd_published_at": "2020-07-28T21:15:00Z", "cwe_ids": [ "CWE-918" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-07-13T21:05:17Z" }- References
Affected packages
Packagist / shopware/platform
Package
- Name
- shopware/platform
- Purl
- pkg:composer/shopware/platform