正文

shopware shopware 信息暴露

admin
admin V管理员 /0 评论 /16 阅读
0421
此篇文章发布距今已超过1155天，您需要注意文章的内容或图片是否可用！

CVE编号

CVE-2021-32717

利用情况

暂无

补丁情况

N/A

披露时间

2021-06-25
漏洞描述
Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL is known. Users are recommend to first change their configuration to set the correct visibility according to the documentation. The visibility must be at the same level as `type`. When the Storage is saved on Amazon AWS we recommending disabling public access to the bucket containing the private files: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html. Otherwise, update to Shopware 6.4.1.1 or install or update the Security plugin (https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659) and run the command `./bin/console s3:set-visibility` to correct your cloud file visibilities.
解决建议
建议您更新当前系统或软件至最新版，完成漏洞的修复。
参考链接
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-06-2021
https://github.com/shopware/platform/commit/ba52f683372b8417a00e9014f481ed3d539f34b3
https://github.com/shopware/platform/security/advisories/GHSA-vrf2-xghr-j52v
受影响软件情况
# 类型 厂商 产品 版本 影响面
1
运行在以下环境
应用 shopware shopware * From
(including)
6.1.0 		Up to
(excluding)
6.4.1.1
CVSS3评分 7.5
  • 攻击路径 网络
  • 攻击复杂度 低
  • 权限要求 无
  • 影响范围 未更改
  • 用户交互 无
  • 可用性 无
  • 保密性 高
  • 完整性 无
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-ID 漏洞类型 CWE-200 信息暴露