CVE-2021-41188

Katalog CVE

CVSS 5.4 · Medium EPSS 0,76%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada shopware. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two workarounds are available. Using the security plugin or adding a particular following config to the `.htaccess` file will protect against cross-site scripting in this case. There is also a config for those using nginx as a server. The plugin and the configs can be found on the GitHub Security Advisory page for this vulnerability.

Rincian

Terbit di NVD

26 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,76% peluang dieksploitasi; lebih tinggi dari 54,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://docs.shopware.com/en/shopware-5-en/sicherheitsupdates/security-update-10-2021 release notes · advisory vendor
• https://github.com/shopware/shopware/commit/37213e91d525c95df262712cba80d1497e395a58 patch · advisory pihak ketiga
• https://github.com/shopware/shopware/security/advisories/GHSA-4p3x-8qw9-24w9 advisory pihak ketiga
• https://github.com/shopware/shopware/releases/tag/v5.7.6 release notes · deskripsi teknis
• https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html product