CVE-2021-32709
published 2021-06-24CVE-2021-32709: Shopware is an open source eCommerce platform. Creation of order credits was not validated by ACL in admin orders. Users are recommend to update to the current…
PriorityP423medium4.9CVSS 3.1
AVNACLPRHUINSUCNIHAN
EPSS
0.63%
45.8th percentile
Shopware is an open source eCommerce platform. Creation of order credits was not validated by ACL in admin orders. Users are recommend to update to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| shopware | platform | < 6.4.1.1 | 6.4.1.1 |
| shopware | platform | >= 0 < 6.4.1.1 | 6.4.1.1 |
| shopware | shopware | < 6.4.1.1 | 6.4.1.1 |
CVSS provenance
nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Missing Authentication for Critical Function
ghsa·2021-06-29
CVE-2021-32709 [MEDIUM] CWE-306 Missing Authentication for Critical Function
Missing Authentication for Critical Function
Shopware is an open source eCommerce platform. Creation of order credits was not validated by ACL in admin orders. Users are recommend to update to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
OSV
Missing Authentication for Critical Function
osv·2021-06-29
CVE-2021-32709 [MEDIUM] Missing Authentication for Critical Function
Missing Authentication for Critical Function
Shopware is an open source eCommerce platform. Creation of order credits was not validated by ACL in admin orders. Users are recommend to update to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-06-24
Published