CVE-2021-32717
mediumPriorität · verfolgen · 31EPSS 0.015 · 73. PerzentilEUUSEPSS · bewertet 2026-10-26
Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL is known. Users are recommend to first change their configuration to set the correct visibility according to the documentation. The visibility must be at the same level as `type`. When the Storage is saved on Amazon AWS we recommending disabling public access to the bucket containing the private files: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html. Otherwise, update to Shopware 6.4.1.1 or install or update the Security plugin (https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659) and run the command `./bin/console s3:set-visibility` to correct your cloud file visibilities.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5–7.5
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (4)
Betroffene Produkte und Versionsbereiche.
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-6gr8-c3m5-mvrgExposure of Sensitive Information to an Unauthorized Actor2021-09-08ghsa · osvUS
Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL is known. Users are recommend to first change their configuration to set the correct visibility according to the documentation. The visibility must be at the same level as `type`. When the Storage is saved on Amazon AWS we recommending disabling public access to the bucket containing the private files: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html. Otherwise, update to Shopware 6.4.1.1 or install or update the Security plugin (https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659) and run the command `./bin/console s3:set-visibility` to correct your cloud file visibilities.
- GHSA-vrf2-xghr-j52vPrivate files publicly accessible with Cloud Storage providers2021-06-28ghsa · osvUS
### Impact Private files publicly accessible with Cloud Storage providers when the hashed URL is known ### Patches We recommend first changing your configuration to set the correct visibility according to the documentation. The visibility must be at the same level as `type`. When the Storage is saved on Amazon AWS we recommending disabling public access to the bucket containing the private files: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html Otherwise, update to Shopware 6.4.1.1 or install or update the Security plugin (https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659) and run the command `./bin/console s3:set-visibility` to correct your cloud file visibilities
auch bekannt als (5)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (11)
Externe Belege — Patches, Meldungen, Analysen.
- https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-06-2021cnnvd
- https://github.com/shopware/platform/commit/ba52f683372b8417a00e9014f481ed3d539f34b3cnnvd
- https://github.com/shopware/platform/security/advisories/GHSA-vrf2-xghr-j52vcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-32717cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021062808cnnvd
- https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-06-2021enisa_euvd
- https://github.com/shopware/platform/commit/ba52f683372b8417a00e9014f481ed3d539f34b3enisa_euvd
- https://github.com/shopware/platform/security/advisories/GHSA-vrf2-xghr-j52venisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan