CVE-2021-41188
lowPriorität · verfolgen · 22EPSS 0.008 · 55. PerzentilEUUSEPSS · bewertet 2026-10-26
Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two workarounds are available. Using the security plugin or adding a particular following config to the `.htaccess` file will protect against cross-site scripting in this case. There is also a config for those using nginx as a server. The plugin and the configs can be found on the GitHub Security Advisory page for this vulnerability.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 3.5–5.7
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (3)
Betroffene Produkte und Versionsbereiche.
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-4p3x-8qw9-24w9Authenticated Stored XSS in shopware/shopware2021-10-27ghsa · osvUS
### Impact Authenticated Stored XSS in Administration ### Patches Use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html ### Workarounds If you cannot use the security plugin, add the following config to your `.htaccess` file ``` <IfModule mod_headers.c> <FilesMatch "\.(?i:svg)$"> Header set Content-Security-Policy "script-src 'none'" </FilesMatch> </IfModule> ``` If you are using nginx as server config, you can add the following to your configuration: ``` server { # ... location ~* ^.+\.svg$ { add_header Content-Security-Policy "script-src 'none'"; } } ``` ### References https://docs.shopware.com/en/shopware-5-en/sicherheitsupdates/security-update-10-2021
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (15)
Externe Belege — Patches, Meldungen, Analysen.
- https://docs.shopware.com/en/shopware-5-en/sicherheitsupdates/security-update-10-2021cnnvd
- https://github.com/shopware/shopware/commit/37213e91d525c95df262712cba80d1497e395a58cnnvd
- https://github.com/shopware/shopware/releases/tag/v5.7.6cnnvd
- https://github.com/shopware/shopware/security/advisories/GHSA-4p3x-8qw9-24w9cnnvd
- https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.htmlcnnvd
- https://docs.shopware.com/en/shopware-5-en/sicherheitsupdates/security-update-10-2021enisa_euvd
- https://github.com/shopware/shopware/commit/37213e91d525c95df262712cba80d1497e395a58enisa_euvd
- https://github.com/shopware/shopware/releases/tag/v5.7.6enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan