Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.6

Shopware 6 XML Data Processing Allows Unauthorized Data Access

published 6 years ago
Summary

Shopware 6's XML data processing can be tricked into revealing sensitive information, even for authorized users. This can happen when the system is processing certain types of XML files. To fix this, update to the latest version of Shopware 6, which is available through the Auto-Updater or on the Shopware download page. For older versions, a patch is available as a plugin, but it's recommended to update to the latest version as soon as possible.

What to do
  • Update shopware platform to version 6.3.2.1.
  • Update shopware core to version 6.3.2.1.
Affected software
Ecosystem VendorProductAffected versions
composer shopware platform <= 6.3.2.0
Fix: upgrade to 6.3.2.1
composer shopware core <= 6.3.2.0
Fix: upgrade to 6.3.2.1
Original advisory text
Authenticated XML External Entity Processing
### Impact
Authenticated XML External Entity Processing

### Patches
We recommend to update to the current version 6.3.2.1. You can get the update to 6.3.2.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-10-2020
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.6 Medium
Type
CWE-611XML External Entity (XXE)
Timeline
Published19 Oct 2020
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-8xv9-qcr9-ww9j · GHSA
Track software like this
Free during beta