CVE-2021-37709

Katalog CVE

CVSS 6.5 · Medium EPSS 0,77%

Kerentanan Insertion of Sensitive Information into Log File pada shopware. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability involving an insecure direct object reference of log files of the Import/Export feature. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.

Rincian

Terbit di NVD

16 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-532: Insertion of Sensitive Information into Log File
CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,77% peluang dieksploitasi; lebih tinggi dari 54,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/shopware/platform/commit/a9f52abb6eb503654c492b6b2076f8d924831fec patch · advisory pihak ketiga
• https://github.com/shopware/platform/security/advisories/GHSA-54gp-qff8-946c advisory pihak ketiga