VDB
Sign up
MEDIUM4.0

GHSA-68wv-g3fw-pq7q

Shopware Broken ACL on Document retrieval to access other customers documents

Quick fix

GHSA-68wv-g3fw-pq7q — shopware/core: upgrade to the fixed version with the command below.

composer require shopware/core:^6.6.10.3

Details

### Impact It's possible to guess the deepLinkCode of an Document to open documents of other customers

### Patches Update to Shopware 6.6.10.3 or 6.5.8.17

### Workarounds For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/shopware/core
Introduced in: 6.6.0.0Fixed in: 6.6.10.3
Fixcomposer require shopware/core:^6.6.10.3
Packagist/shopware/platform
Introduced in: 6.6.0.0Fixed in: 6.6.10.3
Fixcomposer require shopware/platform:^6.6.10.3
Packagist/shopware/core
Introduced in: 6.7.0.0-rc1Fixed in: 6.7.0.0-rc2
Fixcomposer require shopware/core:^6.7.0.0-rc2
Packagist/shopware/platform
Introduced in: 6.7.0.0-rc1Fixed in: 6.7.0.0-rc2
Fixcomposer require shopware/platform:^6.7.0.0-rc2
Packagist/shopware/core
Introduced in: 0Fixed in: 6.5.8.17
Fixcomposer require shopware/core:^6.5.8.17
Packagist/shopware/platform
Introduced in: 0Fixed in: 6.5.8.17
Fixcomposer require shopware/platform:^6.5.8.17

References