Access Restriction Bypass Affecting shopware/core package, versions <6.4.1.1


Severity

Recommended
0.0
low
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Access Restriction Bypass vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-PHP-SHOPWARECORE-1314905
  • published29 Jun 2021
  • disclosed28 Jun 2021
  • creditUnknown

Introduced: 28 Jun 2021

CVE NOT AVAILABLE CWE-284  (opens in a new tab)

How to fix?

Upgrade shopware/core to version 6.4.1.1 or higher.

Overview

shopware/core is a Shopware platform is the core for all Shopware ecommerce products.

Affected versions of this package are vulnerable to Access Restriction Bypass via canceling of orders not related to the logged-in user. This is because the API route for order cancellation does not check the customer scope.

CVSS Scores

version 3.1