Skip to content

After order payment process manipulation in shopware/platform and shopware/core

Critical severity GitHub Reviewed Published Apr 12, 2021 in shopware/shopware • Updated Jan 9, 2023

Package

composer shopware/core (Composer)

Affected versions

<= 6.3.5.2

Patched versions

6.3.5.3
composer shopware/platform (Composer)
<= 6.3.5.2
6.3.5.3

Description

Impact

After order payment process manipulation

Patches

We recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

Workarounds

For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

For more information

https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2021

References

@shopwareBot shopwareBot published to shopware/shopware Apr 12, 2021
Reviewed Apr 12, 2021
Published to the GitHub Advisory Database Apr 13, 2021
Last updated Jan 9, 2023

Severity

Critical

Weaknesses

CVE ID

No known CVE

GHSA ID

GHSA-88rc-3p98-rgvx

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.