GHSA-PJJ4-JJGC-H3R8中危已审查

Authenticated remote code execution

OSV 1.4.0 · github-reviewed · 修改于 2021-03-13 06:28

发布时间

2021-03-13 07:09

GitHub 审查时间

2021-03-13 06:28

NVD 发布时间

—

源文件

advisories/github-reviewed/2021/03/GHSA-pjj4-jjgc-h3r8/GHSA-pjj4-jjgc-h3r8.json

公告说明

Impact

Authenticated remote code execution using plugin manager without ACL permissions.

Patches

We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

Workarounds

For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

For more information

https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-03-2021

受影响的软件包

Packagist

标识信息

别名 / CVE

无

CWE

CWE-74

软件生态

Packagist

扩展资料

暂无扩展资料。

CVSS 评分

没有 CVSS 数据。

原始 OSV JSON

{
  "id": "GHSA-pjj4-jjgc-h3r8",
  "aliases": [],
  "details": "### Impact\nAuthenticated remote code execution using plugin manager without ACL permissions.\n\n### Patches\nWe recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview.\n\nhttps://www.shopware.com/en/download/#shopware-6\n\n### Workarounds\nFor older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.\n\nhttps://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659\n\n### For more information\nhttps://docs.shopware.com/en/shopware-6-en/security-updates/security-update-03-2021",
  "summary": "Authenticated remote code execution",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.3.5.2"
            }
          ]
        }
      ],
      "package": {
        "name": "shopware/platform",
        "ecosystem": "Packagist"
      },
      "database_specific": {
        "last_known_affected_version_range": "<= 6.3.5.1"
      }
    }
  ],
  "modified": "2021-03-12T22:28:01Z",
  "severity": [],
  "published": "2021-03-12T23:09:24Z",
  "references": [
    {
      "url": "https://github.com/shopware/platform/security/advisories/GHSA-pjj4-jjgc-h3r8",
      "type": "WEB"
    },
    {
      "url": "https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-03-2021",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-74"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2021-03-12T22:28:01Z"
  }
}