SB2019011513 - Externally Controlled Reference to a Resource in Another Sphere in Shopware Shopware
Published: January 15, 2019 Updated: July 17, 2020
Security Bulletin ID
SB2019011513
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Externally Controlled Reference to a Resource in Another Sphere (CVE-ID: CVE-2017-18357)
The vulnerability allows a remote authenticated user to gain access to sensitive information.
Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller, with resultant XXE via instantiation of a SimpleXMLElement object.
Remediation
Install update from vendor's website.