GHSA-r4ph-mx67-x58p

ghsaUSosv

Shopware database password is leaked to an unauthenticated users

view advisory published 2022-05-24Licence: CC-BY-4.0

In Shopware 6 before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled. This vulnerability does not affect the shopware 5 release branch (`shopware/shopware` on packagist).

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-13997US	high7.5	1.49% (74th)	—	2020-07-28
In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled.

references

External citations — patches, advisories, analysis.

https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-07-2020WEB
https://github.com/shopware/shopwarePACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2020-13997ADVISORY
https://www.shopware.com/en/changelog/#6-2-3WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan